Risk Response and Mitigation CRISC Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A logistics company has a risk of vehicle breakdowns causing delivery delays. The risk owner is evaluating responses: (A) purchase a maintenance contract for $100,000 per year, reducing the expected annual loss from $500,000 to $50,000; (B) accept the risk because breakdowns are infrequent; (C) transfer the risk by using a third-party delivery service for critical routes. The company's risk appetite allows for some delivery delays, but the risk owner wants to minimize net cost. Which response is most cost-effective?

   • APurchase the maintenance contract because the reduction in expected loss exceeds the cost.
   • BAvoid the risk by discontinuing delivery services.
   • CTransfer the risk by using a third-party delivery service for critical routes.
   • DAccept the risk because breakdowns are infrequent and the maintenance cost is high.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A bank has implemented a risk action plan to mitigate the risk of insider trading by enhancing monitoring and training. The plan includes deploying new surveillance software and conducting quarterly training. The risk owner wants to ensure that the plan is on track and that any issues are escalated promptly. Which monitoring approach is most effective?

   • AEstablish KPIs for each action item and review them monthly, with escalation triggers for missed milestones.
   • BRely on the project manager to report only when a task is completed.
   • CWait for the internal audit to identify any deficiencies.
   • DConduct a single review at the end of the year to assess overall completion.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   When selecting a risk response, which criterion compares the cost of implementing the response against the expected reduction in risk?

   • AStrategic alignment
   • BRisk tolerance
   • CCost-benefit analysis
   • DRegulatory compliance
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A large organization has a risk of unauthorized access to its HR system. The risk owner has approved a mitigation plan that includes implementing multi-factor authentication (MFA) and enhancing access reviews. The IT security team is responsible for deploying MFA, and the HR department is responsible for conducting access reviews. The plan has a 6-month timeline. The risk owner wants to ensure accountability and timely completion. Which action best ensures that the risk response is effectively managed?

   • AAssign the risk owner as the accountable party for the overall response, with the IT security team and HR as responsible parties for their tasks.
   • BDelegate full accountability to the IT security team because they are implementing the most critical control.
   • CLet the HR department manage the entire plan because they own the data.
   • DHave the internal audit team monitor the plan and report directly to the board.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   In a risk action plan, which element specifies who is responsible for completing each action step?

   • AResponsibilities
   • BResources
   • CTimeline
   • DRisk appetite
   Reveal Solution Discussion Select an answer first