Risk Monitoring and Reporting CRISC Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A bank's risk committee wants a single-page summary that tracks the status of its top 10 risks, the effectiveness of associated controls, and whether key risk indicators are within tolerance. The summary will be reviewed monthly. Which reporting format is most suitable?

   • AA dashboard with real-time feeds of all operational incidents.
   • BA risk scorecard that consolidates risk ratings, control effectiveness scores, and KRI status into a structured table.
   • CA heatmap showing only the likelihood and impact of the top 10 risks.
   • DA detailed narrative report describing each risk and control in depth.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A technology company has identified a new vulnerability in a widely used software component that could affect its products. The vulnerability is not yet publicly disclosed, and the company has limited information about its exploitability. The risk team must communicate this to senior management. What is the most appropriate approach?

   • ACommunicate the potential risk to senior management with the available information, clearly stating the uncertainty and planned next steps.
   • BWait until the vulnerability is publicly disclosed and fully understood before communicating anything.
   • CInclude the risk in the next quarterly risk report without any interim communication.
   • DCommunicate the risk as a confirmed high-impact event to ensure management takes it seriously.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A pharmaceutical company is aware of a new regulatory proposal in a key market that could affect its product approval process. The proposal is still in draft form and the details are uncertain. The risk team needs to monitor this development and communicate its potential impact to senior management. What is the most appropriate initial action?

   • AImmediately classify the risk as high impact and high likelihood and allocate a large budget to mitigate it.
   • BEstablish a process to track the regulatory proposal's progress, gather expert analysis, and report its potential impact to management as it evolves.
   • CWait until the regulation is finalized before assessing its impact to avoid wasting resources on speculation.
   • DInclude the risk in the next annual risk assessment report without any interim communication.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   What does a Key Control Indicator (KCI) primarily measure?

   • AThe financial impact of a realized risk
   • BThe overall performance of a business unit
   • CThe likelihood of a risk event occurring
   • DThe effectiveness of an internal control in mitigating risk
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   What is the primary characteristic of an emerging risk?

   • AIt is a well-known risk that has been stable for many years
   • BIt has already occurred and caused significant financial loss
   • CIt is not yet fully understood and its likelihood and impact are uncertain
   • DIt is a risk that is easily quantified using historical data
   Reveal Solution Discussion Select an answer first