Governance Framework CRISC Practice Questions (Page 6)

Questions 26–27

1. 26expert · hard

   A hospital's board has a strategic goal to improve patient outcomes. The IT department proposes a new telehealth platform. The risk committee is concerned about patient data privacy and the organization's conservative risk culture. The board must decide whether to proceed. What is the BEST course of action?

   • AApprove the project with mandatory privacy controls and a phased rollout
   • BApprove the project without additional controls to speed up implementation
   • CDefer the decision until the risk culture changes
   • DReject the project because it conflicts with the conservative risk culture
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A technology startup has a culture that rewards rapid innovation and accepts frequent failures. The board is concerned that this culture may lead to excessive risk-taking. What is the MOST EFFECTIVE way to influence the culture toward a more balanced risk posture?

   • ATerminate employees who take excessive risks
   • BImplement a strict approval process for all new projects
   • CEstablish a formal risk appetite statement and communicate it through training
   • DOutsource high-risk projects to third parties
   Reveal Solution Discussion Select an answer first