It is MOST important to the effectiveness of an IT risk management function that the associated processes are:

• A.periodically assessed against regulatory requirements.
• B.updated and monitored on a continuous basis.
• C.reviewed and approved by senior management.
• D.aligned to an industry-accepted framework.

Comment: *

Name: *

Email: *

Verification: *

What is the MOST important consideration when aligning IT risk management with the enterprise risk management (ERM) framework?

• A.Business unit support
• B.Senior management participation
• C.Risk nomenclature and taxonomy
• D.Risk and control ownership

Comment: *

Name: *

Email: *

Verification: *

What is the GREATEST concern with maintaining decentralized risk registers instead of a consolidated risk register?

• A.Aggregated risk may exceed the enterprise's risk appetite and tolerance.
• B.Duplicate resources may be used to manage risk registers.
• C.Standardization of risk management practices may be difficult to enforce.
• D.Risk analysis may be inconsistent due to non-uniform impact and likelihood scales.

Comment: *

Name: *

Email: *

Verification: *

Following a significant change to a business process, a risk practitioner believes the associated risk has been reduced. The risk practitioner should advise the risk owner to FIRST

• A.reallocate risk response resources.
• B.review the key risk indicators.
• C.conduct a risk analysis.
• D.update the risk register

Comment: *

Name: *

Email: *

Verification: *

Which of the following is the MOST important reason to maintain key risk indicators (KRIs)?

• A.In order to avoid risk
• B.Complex metrics require fine-tuning
• C.Risk reports need to be timely
• D.Threats and vulnerabilities change over time
• E.Explanation:
  Threats and vulnerabilities change over time and KRI maintenance ensures that KRIs continue to effectively capture these changes. The risk environment is highly dynamic as the enterprise's internal and external environments are constantly changing. Therefore, the set of KRIs needs to be changed over time, so that they can capture the changes in threat and vulnerability.

Comment: *

Name: *

Email: *

Verification: *