Risk Register CRISC Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following best describes the role of a risk register in the risk management process?

   • AA static list created once at the start of a project
   • BA communication tool used only for external stakeholders
   • CA dynamic document that evolves as risks are identified, assessed, and managed
   • DA tool used exclusively for risk response planning
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company has assigned a risk owner for each risk in the register, but the register is not being updated consistently. The risk owners say they do not know when to update it. What is the best way to clarify accountability?

   • ADefine a clear update schedule and trigger events for each risk owner.
   • BSend a reminder email to all staff to update the register monthly.
   • CWait until the next annual risk assessment to update the register.
   • DAsk the CISO to update the register for all risk owners.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company has a risk register that is not integrated with its incident management process. When an incident occurs, the related risk is not updated in the register. This has led to outdated risk levels and missed opportunities to improve controls. What is the most effective way to integrate the two processes?

   • AHave the risk management team monitor incidents and update the register monthly.
   • BCreate a separate incident log and do not link it to the risk register.
   • CEstablish a procedure that requires incident responders to update the related risk register entry after an incident.
   • DReview the risk register annually and adjust based on incidents from the past year.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A risk assessment identifies a new risk that requires a mitigation plan. The risk owner has proposed a control. How should the risk register be used to integrate this into the risk management process?

   • ARecord the risk, the proposed control, the residual risk after the control, and the target completion date.
   • BWait until the control is implemented before adding the risk to the register.
   • CAdd the risk to the register only if it is rated as high.
   • DRecord only the risk description and likelihood.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A risk that was previously rated as low has increased in likelihood due to new threat intelligence. The risk owner has not updated the register. What is the most appropriate action?

   • AUpdate the register with the new likelihood and recalculate the risk level.
   • BInform the board before updating the register.
   • CChange the risk owner because they failed to update.
   • DWait until the next scheduled review to update the register.
   Reveal Solution Discussion Select an answer first