Risk Monitoring and Reporting CRISC Practice Questions (Page 9)

Questions 41–44

1. 41expert · hard

   A risk team is developing a KRI for cyber risk. They have identified a potential metric: the number of phishing emails reported by employees. However, they are concerned that this metric may not be reliable because employees may not report all phishing emails. The team wants to ensure the KRI is accurate and useful. Which action is most appropriate?

   • AUse the number of reported phishing emails as the KRI without further validation because it is the only available data.
   • BAggregate the reported phishing emails with data from other sources, such as firewall logs, without validating the reporting rate.
   • CReplace the KRI with the number of successful phishing attacks, which is a more direct measure.
   • DValidate the metric by comparing reported phishing emails against a sample of simulated phishing campaigns to estimate the reporting rate.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A risk manager needs to present the current risk profile to the board, highlighting that two risks have increased in likelihood over the past quarter while their impact remains unchanged. The board is familiar with a standard 5x5 risk matrix. Which reporting format is most effective for this communication?

   • AA heatmap with the two risks repositioned to reflect the increased likelihood, using color coding to show the new risk levels.
   • BA scorecard listing the two risks with their current likelihood and impact ratings in a table.
   • CA detailed written report describing the two risks and their changes in likelihood.
   • DA dashboard showing the number of risk incidents reported in the last quarter.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A project manager reports that the IT team has completed 95% of the planned system upgrades for the quarter. The risk team wants to understand if this performance is relevant to the risk of system obsolescence. Which statement correctly differentiates this metric from a KRI or KCI?

   • AIt is both a KPI and a KRI because it relates to both performance and risk.
   • BIt is a KRI because completing upgrades reduces the risk of obsolescence.
   • CIt is a KCI because the upgrade process is a control against obsolescence.
   • DIt is a KPI because it measures the performance of the upgrade process, not the risk of obsolescence or the effectiveness of a control.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   An organization has a control that requires segregation of duties for financial transactions. Management wants to monitor whether this control is operating effectively on an ongoing basis, without relying solely on periodic audits. Which technique is most appropriate?

   • AImplement automated monitoring that flags transactions where the same user performed conflicting duties.
   • BReview the segregation of duties policy annually to ensure it is up to date.
   • CConduct an annual audit of a sample of financial transactions to check for segregation of duties violations.
   • DAsk employees to self-certify that they do not perform conflicting duties.
   Reveal Solution Discussion Select an answer first