Risk Management CRISC Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A financial institution is implementing the three lines of defense model. The first line (business units) has been given responsibility for identifying and managing risks in their operations. The second line (risk management) is responsible for monitoring and challenging the first line's risk activities. The third line (internal audit) provides independent assurance. However, the internal audit function has been asked to help the first line design and implement new controls for a critical process. What is the most appropriate response from internal audit?

   • ADecline the request to maintain independence and objectivity
   • BProvide advice and guidance but not take ownership of the control design
   • CDesign and implement the controls to ensure they are effective
   • DDelegate the task to the second line of defense
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A public sector organization is required to implement a risk management framework that emphasizes internal control and is widely used for compliance with financial reporting regulations. The organization's leadership wants a framework that integrates risk management with internal control and can be used to evaluate the effectiveness of internal controls. Which framework is most appropriate?

   • AISO 31000
   • BCOSO Internal Control – Integrated Framework
   • CCOBIT
   • DNIST Risk Management Framework
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   In a large bank, the compliance function is responsible for monitoring adherence to regulatory requirements and providing guidance to business units on compliance risks. According to the three lines of defense model, which line of defense does the compliance function represent?

   • ASecond line of defense
   • BFourth line of defense
   • CThird line of defense
   • DFirst line of defense
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A multinational corporation is implementing an ERM program. The board has approved a risk appetite that is aggressive for market expansion but conservative for operational risk. The risk team is tasked with developing a risk profile that aligns with this appetite. During the process, they discover that the organization's current risk exposure in operational areas is higher than the conservative tolerance. The board is unwilling to change its risk appetite. What is the most appropriate course of action for the risk team?

   • ADevelop a risk treatment plan to reduce operational risk exposure to within the approved tolerance
   • BReclassify operational risks as market risks to align with the aggressive appetite
   • CRevise the risk profile to reflect the actual exposure and recommend that the board adjust its risk appetite
   • DAccept the operational risk exposure as a strategic decision to support market expansion
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A technology company is preparing its risk profile for the board. The company has a high risk appetite for innovation, but a low tolerance for data breaches. The risk team has identified that the company's current risk exposure for data breaches is within the low tolerance. However, the company is planning to launch a new product that will significantly increase the amount of customer data it processes. What should the risk team do when developing the risk profile?

   • AKeep the current risk profile unchanged because the new product has not been launched yet
   • BIncrease the risk tolerance for data breaches to accommodate the new product
   • CInclude the projected increase in data breach risk from the new product in the risk profile
   • DExclude the new product from the risk profile until it is fully launched
   Reveal Solution Discussion Select an answer first