Risk Management CRISC Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is a key component of the COSO ERM framework?

   • ASoftware development lifecycle
   • BMarketing mix analysis
   • CStrategy and objective-setting
   • DNetwork security controls
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A manufacturing company has implemented the three lines of defense model. The first line (operations) is responsible for managing safety risks in the plant. The second line (risk management) has identified a significant safety risk that the first line has not adequately addressed. The second line has escalated the issue to the audit committee. What is the most appropriate action for the audit committee?

   • ATake over the management of the safety risk from the first line
   • BDirect the first line to take corrective action and report back to the audit committee
   • CWait for the next internal audit to assess the risk
   • DRequest that the second line implement controls to mitigate the risk
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   In the three lines of defense model, which line is responsible for owning and managing risks?

   • ASecond line of defense
   • BFirst line of defense
   • CThird line of defense
   • DBoard of directors
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A software company has a contractual obligation with a client to maintain a specific level of service availability (99.9% uptime). The company's risk appetite statement does not explicitly address service availability. The risk team is developing the risk profile and needs to determine how to treat this contractual obligation. What should the risk team do?

   • ATreat the contractual obligation as a risk that must be managed within the company's risk appetite
   • BTransfer the risk to the client by renegotiating the contract
   • CIgnore the contractual obligation because it is not a regulatory requirement
   • DAssume the risk appetite automatically covers all contractual obligations
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A retail company has separate risk management activities in its IT, finance, and operations departments, each using different frameworks and reporting to different executives. The board is concerned about the lack of a unified view of risk across the organization. Which initiative would best address the board's concern?

   • AOutsource risk management to a third-party consultant
   • BCreate a separate risk register for each department to improve documentation
   • CAdopt a single risk framework for all departments
   • DImplement an enterprise risk management (ERM) program that aligns risk activities across all departments
   Reveal Solution Discussion Select an answer first