Risk Management CRISC Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A technology startup has a high risk appetite for innovation but must comply with the Payment Card Industry Data Security Standard (PCI DSS) for its payment processing. The board has set a risk tolerance that allows for no more than one PCI DSS compliance violation per year. During a quarterly review, the risk team finds that the company has already had two violations this year. What should the risk team do first?

   • AReport the breach of tolerance to the board and recommend corrective actions
   • BIncrease the risk tolerance to three violations per year to accommodate the company's innovation goals
   • CHide the violations from the board to avoid negative attention
   • DWait until the end of the year to see if more violations occur
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   How do legal and regulatory requirements influence an organization's risk posture?

   • AThey are optional guidelines that organizations can choose to follow
   • BThey only apply to financial institutions
   • CThey establish minimum standards that the organization must meet
   • DThey eliminate the need for internal risk assessments
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary purpose of Enterprise Risk Management (ERM)?

   • ATo focus solely on financial risks
   • BTo manage risks in a coordinated and integrated manner across the entire organization
   • CTo eliminate all risks that could affect the organization
   • DTo transfer all risks to insurance providers
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which of the following is typically included in a risk profile?

   • ARisk categories and their likelihood and impact
   • BCustomer satisfaction scores
   • CProduct pricing details
   • DEmployee performance reviews
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A large insurance company is implementing an ERM program. The company has a decentralized structure with business units operating independently. The ERM team is tasked with integrating risk management across the organization. The business units are resistant to a centralized approach because they believe it will slow down decision-making. What is the most effective strategy for the ERM team to overcome this resistance?

   • AMandate a centralized risk management process and require all business units to comply
   • BAllow each business unit to continue its own risk management approach to avoid conflict
   • CDemonstrate how ERM can provide value to business units by improving risk visibility and supporting better decision-making
   • DFocus only on the risks that are common across all business units
   Reveal Solution Discussion Select an answer first