Risk Response and Mitigation CRISC Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   An organization with a low risk appetite is evaluating a risk that, if realized, could cause significant financial loss. Which risk response is most likely to be selected, assuming the risk can be reduced?

   • ATransfer
   • BMitigate
   • CAvoid
   • DAccept
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A financial services firm has identified a risk of unauthorized access to customer data. The risk owner has approved a mitigation plan that includes implementing multi-factor authentication (MFA) and enhancing access reviews. The IT security team is responsible for deploying the MFA solution. Which role is accountable for ensuring that the MFA implementation is completed and effective?

   • AThe control owner, who is responsible for operating the MFA control.
   • BThe internal audit team, which verifies the effectiveness of controls.
   • CThe IT security team lead, who is responsible for deploying the MFA solution.
   • DThe risk owner, who has overall accountability for managing the risk.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company has implemented a risk action plan to mitigate the risk of data breaches by enhancing encryption and access controls. The plan has a 12-month timeline. The risk owner wants to track progress and identify potential delays early. Which approach is most effective for monitoring the action plan?

   • ADefine key performance indicators (KPIs) for each action item and review them monthly.
   • BConduct a single comprehensive review at the halfway point.
   • CRely on the control owners to report only when they encounter problems.
   • DWait until the 12-month deadline to assess whether the plan was completed.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A financial institution has a risk of fraud in its online banking platform. The risk owner has approved a mitigation plan that includes implementing real-time transaction monitoring and enhancing customer authentication. The IT team is responsible for deploying the monitoring system, and the fraud operations team is responsible for reviewing alerts. The plan has a 6-month timeline. The risk owner wants to ensure that the response is effective and that any issues are escalated to the board if necessary. Which action is most important for the risk owner to take?

   • ADelegate the monitoring of the plan to the IT team because they are implementing the system.
   • BWait for the internal audit to assess the effectiveness of the controls after implementation.
   • CRely on the fraud operations team to report any issues they encounter.
   • DEstablish a clear escalation path for unresolved issues and define KPIs to measure the effectiveness of the controls.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which risk response option involves taking actions to reduce the likelihood or impact of a risk to an acceptable level?

   • AAccept
   • BTransfer
   • CMitigate
   • DAvoid
   Reveal Solution Discussion Select an answer first