Risk Monitoring and Reporting CRISC Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is a typical component of a risk scorecard?

   • AA detailed timeline of all risk events
   • BThe full text of the risk management policy
   • CA list of all employees and their roles
   • DKey Risk Indicators (KRIs) with target and actual values
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A retail company collects data on customer complaints, system downtime, and employee turnover from different departments. The risk team wants to identify whether these factors are correlated with a decline in sales. The data is in different formats and stored in separate systems. What is the most appropriate first step?

   • AAggregate the data into a common format and perform correlation analysis to identify relationships with sales trends.
   • BCreate a heatmap of the raw data to visually present the information.
   • CReport the raw data from each department separately to the board for their interpretation.
   • DFocus only on customer complaints because they are most directly related to sales.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   A risk analyst receives a report of security incidents from an automated system. What is the most important first step to ensure the data is suitable for risk analysis?

   • AConvert the data into a graphical format for presentation
   • BImmediately aggregate the data with other risk information
   • CValidate the accuracy and completeness of the incident data
   • DDistribute the data to all stakeholders for review
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which method is most appropriate for collecting risk-related data from employees who perform day-to-day operational processes?

   • AExternal threat intelligence subscriptions
   • BAutomated log collection from network devices
   • CReview of board meeting minutes
   • DControl self-assessments and interviews
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A risk analyst is aggregating data from multiple business units to produce a quarterly risk report. The analyst notices that one business unit's data on control failures is significantly lower than in previous quarters, while other units show consistent trends. The analyst suspects a data quality issue. Which action is most appropriate to validate the data?

   • AExclude the business unit's data from the report to avoid presenting unreliable information.
   • BAccept the data as correct because the business unit reported it through the official system.
   • CCompare the business unit's data against source system records and follow up with the unit's risk coordinator to confirm the figures.
   • DAdjust the business unit's data to match the historical average to make the report consistent.
   Reveal Solution Discussion Select an answer first