Risk Monitoring and Reporting CRISC Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   When reporting an emerging risk to stakeholders, what is the most important consideration?

   • ACommunicating the risk in a timely manner, even if information is incomplete
   • BAvoiding communication until the risk has materialized
   • CReporting only to the risk management team and no one else
   • DWaiting until the risk is fully quantified before reporting
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A risk manager is preparing a heatmap for the board. The board has expressed concern that the heatmap is too complex and wants to focus on the most critical risks. The risk manager has identified 25 risks, but the board wants to see only those that require immediate attention. Which approach is most appropriate?

   • APresent a heatmap with all 25 risks, using different colors to distinguish critical from non-critical risks.
   • BPresent a heatmap showing only the risks that fall in the high-likelihood and high-impact zones, with a note that other risks are tracked separately.
   • CPresent a detailed scorecard listing all 25 risks with their ratings and controls.
   • DPresent a narrative report describing the top 5 risks in detail.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company wants to implement a dashboard for real-time risk monitoring. The data sources include internal systems with different update frequencies, some updating every minute and others updating daily. The risk team is concerned that the dashboard may show inconsistent data. Which approach is most appropriate?

   • AUse only the daily data sources in the dashboard to avoid inconsistency.
   • BAggregate all data into a single daily snapshot to ensure consistency.
   • CDefine clear data refresh schedules and label each dashboard component with its last update time to manage expectations.
   • DForce all data sources to update at the same frequency, such as every minute, to ensure consistency.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company has a mature control environment but is facing a rapidly changing regulatory landscape. Management wants to ensure that existing controls remain effective and that emerging regulatory risks are identified early. The company has limited resources and cannot conduct frequent full audits. Which approach best balances these needs?

   • ARely on control self-assessments from business units to identify both control issues and emerging risks.
   • BFocus all resources on monitoring emerging regulatory risks and defer control monitoring to the next audit.
   • CImplement continuous monitoring of key controls and establish a process to scan regulatory changes for emerging risks.
   • DConduct a comprehensive annual audit of all controls and regulatory compliance.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   After aggregating risk data, what is the primary goal of the analysis phase?

   • ATo produce descriptive statistics for the annual report
   • BTo convert all qualitative data into quantitative scores
   • CTo derive meaningful insights that support informed decision-making
   • DTo validate that the data collection process was error-free
   Reveal Solution Discussion Select an answer first