Risk Register CRISC Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A risk owner is updating the register for a risk that has been mitigated by implementing a new access control system. Which information should be captured to reflect the current state?

   • AThe cost of the control and the vendor's name.
   • BThe original risk level and the date the risk was first identified.
   • CThe risk owner's name and the department budget.
   • DThe residual risk level after the control, the control's effectiveness, and the updated risk status.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which of the following is an essential field in a risk register that identifies the individual responsible for managing a specific risk?

   • ARisk Category
   • BRisk ID
   • CRisk Owner
   • DRisk Level
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company's risk register currently contains only high-level summaries of risks, such as 'potential data breach' and 'supply chain disruption.' The CISO wants to use the register to track risk treatment progress and to support quarterly risk reviews. Which action best aligns the register with its intended purpose?

   • AConvert the register into a risk assessment report and distribute it annually.
   • BMove the register to a spreadsheet and share it with all employees for transparency.
   • CAdd detailed fields for each risk, including likelihood, impact, risk owner, current controls, and treatment status.
   • DDelete risks that have not materialized in the past year to keep the register concise.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   During a risk assessment, a risk is identified that is currently mitigated by an existing control. The control is documented in the register. What additional information should be captured to support future risk response decisions?

   • AThe control's cost and the vendor's support contract.
   • BThe control's implementation date and the employee who installed it.
   • CThe control's effectiveness and the residual risk level.
   • DThe control's name and the department that funded it.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A company has a risk register that is integrated with its risk management framework. A new regulation requires the company to demonstrate that risks are reviewed and updated at least quarterly. The current process updates the register only after a risk materializes. What is the best way to align the register with the framework and the regulation?

   • AImplement a quarterly review cycle where risk owners confirm or update each risk's likelihood, impact, and controls.
   • BMove the register to a new software tool that automates updates.
   • CAssign an external auditor to update the register quarterly.
   • DContinue the current process and document that risks are reviewed after materialization.
   Reveal Solution Discussion Select an answer first