Risk Register CRISC Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   When documenting a risk in the register, which of the following should be included as a data input?

   • AThe organization's strategic plan
   • BThe risk assessment team's meeting minutes
   • CThe risk response strategy selected
   • DThe risk owner's performance review scores
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A risk register entry for a critical vendor risk includes the risk description, likelihood, impact, and owner. The risk owner is leaving the company. What is the most important update to make to the register?

   • ADelete the risk because the owner is leaving.
   • BIncrease the likelihood because the owner is leaving.
   • CAssign a new risk owner and update the owner field.
   • DMove the risk to a 'closed' status.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   How does the risk register support communication of risk information to management?

   • ABy storing risks only for the risk management team
   • BBy providing a consolidated view of risks that informs decision-making
   • CBy replacing the need for risk reports
   • DBy automatically implementing risk responses
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A risk register is updated only once a year during the annual risk assessment. The company has experienced significant changes in its IT environment and threat landscape. What is the most appropriate way to maintain the register?

   • AUpdate the register whenever a new risk is identified or an existing risk changes materially.
   • BUpdate the register only after a risk materializes.
   • CHave the internal audit team update the register quarterly.
   • DContinue annual updates to avoid overburdening staff.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A risk register contains a risk with a high likelihood and high impact. The risk owner has proposed a control that is expected to reduce likelihood but not impact. The register currently shows the inherent risk level. What should be updated in the register to reflect the proposed response?

   • ARecord the proposed control, the expected residual likelihood, and the unchanged impact.
   • BChange the risk level to low because a control is planned.
   • CUpdate the impact to a lower value because the control reduces risk.
   • DLeave the register unchanged until the control is fully implemented.
   Reveal Solution Discussion Select an answer first