Risk Management CRISC Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A large energy company is developing its risk profile for the upcoming fiscal year. The company operates in multiple countries with varying regulatory environments. The risk team has identified that the company's risk exposure in the area of environmental compliance is within the overall risk appetite, but the tolerance for a specific country is much lower due to local regulations. The risk profile currently aggregates all environmental risks into a single figure. What is the most appropriate action for the risk team?

   • AKeep the aggregated figure because the overall risk is within appetite
   • BRemove the country-specific risk from the profile to simplify reporting
   • CIncrease the risk tolerance for the specific country to align with the overall appetite
   • DBreak down the risk profile by country to reflect the different tolerance levels
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A financial services firm is updating its risk appetite statement. The board has approved a risk appetite that allows for moderate risk-taking in new product development to remain competitive, but the firm must also comply with strict capital adequacy regulations. The risk team is now setting specific limits for how much capital can be allocated to new product ventures. Which of the following best describes what the risk team is defining?

   • ARisk register
   • BRisk profile
   • CRisk tolerance
   • DRisk capacity
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the impact of contractual requirements on risk management?

   • AThey can impose specific risk management obligations on the organization
   • BThey are less important than regulatory requirements
   • CThey only affect legal departments
   • DThey have no impact on risk management
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A global technology company is expanding its operations into a new country. The legal department has identified that the new country's data protection law requires that personal data of its citizens be stored within the country's borders. The company's current risk appetite allows for moderate risk-taking, but the board has stated that regulatory compliance is a top priority. What is the most appropriate initial action for the risk management team?

   • AImmediately move all data to a cloud provider with servers in the new country
   • BUpdate the risk appetite statement to exclude data residency risks
   • CIgnore the requirement until the company begins operations in the new country
   • DConduct a risk assessment to evaluate the impact of the data residency requirement on current operations and identify compliance gaps
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A healthcare organization is preparing its annual risk profile report for the board. The organization has identified that its risk exposure in the area of patient data privacy is higher than its established risk tolerance, due to recent changes in data protection regulations. According to best practices, what should the organization do with this information in the risk profile?

   • AReport only the risks that are within tolerance to present a favorable view
   • BDocument the elevated risk exposure and communicate it to the board with recommended actions
   • CAdjust the risk tolerance to match the current exposure to avoid reporting an exception
   • DRemove the privacy risk from the profile since it is already known to the board
   Reveal Solution Discussion Select an answer first