In a standard risk heatmap, what do the two axes typically represent?

Control effectiveness and risk appetite

An organization has implemented a new control requiring all access requests to be approved by the data owner. Management wants to measure whether this control is operating effectively over time. Which metric is most appropriate?

The total number of access requests received in the last month.

The percentage of access requests that were approved by the data owner within the required timeframe.

The average time taken to provision a new user account.

The number of access-related security incidents reported in the last quarter.

What is the primary difference between a Key Performance Indicator (KPI) and a Key Risk Indicator (KRI)?

A KPI measures control effectiveness, while a KRI measures business outcomes

A KPI is a leading indicator, while a KRI is a lagging indicator

A KPI is used for external reporting, while a KRI is used for internal reporting

A KPI measures business performance, while a KRI measures the level of risk exposure

A risk team has collected data on control failures from multiple business units. What is the primary purpose of aggregating this data before analysis?

To ensure that data is stored in a single, centralized repository

To replace the need for individual unit-level risk assessments

To identify patterns and trends across the organization

To simplify the data so that only quantitative information is retained

On a risk heatmap, what does the color red typically indicate?

A low level of risk that is within risk appetite

A risk that is no longer relevant

A risk that has been fully mitigated

A high level of risk that requires immediate attention

Certified in Risk and Information Systems Control

Domain 3Objective 4

Risk Monitoring and Reporting CRISC Practice Questions (Page 4)

Part of the Domain 3: Risk Response and Reporting domain, which accounts for 32% of the CRISC exam.

44questions here

9free pages

14concepts

32%of the exam

Questions 16–20

16foundation · easy
In a standard risk heatmap, what do the two axes typically represent?
Select an answer first
17application · medium
An organization has implemented a new control requiring all access requests to be approved by the data owner. Management wants to measure whether this control is operating effectively over time. Which metric is most appropriate?
Select an answer first
18foundation · easy
What is the primary difference between a Key Performance Indicator (KPI) and a Key Risk Indicator (KRI)?
Select an answer first
19foundation · easy
A risk team has collected data on control failures from multiple business units. What is the primary purpose of aggregating this data before analysis?
Select an answer first
20foundation · easy
On a risk heatmap, what does the color red typically indicate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CRISC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CRISC” is a trademark of its owner, used for identification only.