When should the risk register be updated?

Whenever a new risk is identified or an existing risk changes

Only when requested by external auditors

Only at the end of the fiscal year

Which of the following best describes how the risk register is used in reporting to stakeholders?

It is used only for internal audit purposes

It serves as the primary source for risk-related reports and dashboards

It is a confidential document that cannot be shared

It is used to replace verbal communication about risks

A company is implementing a new risk management framework and wants to use the risk register as the central tool for risk assessment, response, and monitoring. The current register is a simple list of risks with no fields for controls or treatment plans. What is the most important first step to make the register effective?

Migrate the register to a cloud-based tool immediately.

Redesign the register to include fields for controls, treatment plans, owners, and status.

Populate the register with all historical risks first.

Train all employees on how to use the register.

What is the primary purpose of a risk register in the risk management process?

To store only the risks that have been fully mitigated

To replace the need for regular risk assessments

To serve as a central repository for documenting and tracking identified risks

To provide a legal defense in case of a security breach

A company's risk register is maintained by the IT department, but business units do not have visibility into risks that affect their operations. What is the best way to improve ownership and communication?

Publish the register on the public website.

Keep the register in IT and share it only with the CISO.

Assign risk owners from each business unit and provide them access to relevant register data.

Create a separate register for each business unit.

Certified in Risk and Information Systems Control

Domain 2Objective 7

Risk Register CRISC Practice Questions (Page 4)

Part of the Domain 2: Risk Assessment domain, which accounts for 22% of the CRISC exam.

34questions here

7free pages

7concepts

22%of the exam

Questions 16–20

16foundation · easy
When should the risk register be updated?
Select an answer first
17foundation · easy
Which of the following best describes how the risk register is used in reporting to stakeholders?
Select an answer first
18expert · hard
A company is implementing a new risk management framework and wants to use the risk register as the central tool for risk assessment, response, and monitoring. The current register is a simple list of risks with no fields for controls or treatment plans. What is the most important first step to make the register effective?
Select an answer first
19foundation · easy
What is the primary purpose of a risk register in the risk management process?
Select an answer first
20application · medium
A company's risk register is maintained by the IT department, but business units do not have visibility into risks that affect their operations. What is the best way to improve ownership and communication?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CRISC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CRISC” is a trademark of its owner, used for identification only.