Shelly is the project manager of the BUF project for her company. In this project Shelly needs to establish some rules to reduce the influence of risk bias during the qualitative risk analysis process. What method can Shelly take to best reduce the influence of risk bias?

• A.Establish risk boundaries
• B.Group stakeholders according to positive and negative stakeholders and then complete the risk analysis
• C.Determine the risk root cause rather than the person identifying the risk events
• D.Establish definitions of the level of probability and impact of risk event

Comment: *

Name: *

Email: *

Verification: *

The PRIMARY purpose of using control metrics is to evaluate the:

• A.amount of risk present in the organization.
• B.variance against objectives.
• C.amount of risk reduced by compensating controls.
• D.number of incidents.

Comment: *

Name: *

Email: *

Verification: *

What is the PRIMARY purpose of a business impact analysis (BIA)?

• A.To evaluate the priority of business operations in case of disruption
• B.To estimate resource requirements for related business processes
• C.To determine the likelihood and impact of threats to business operations
• D.To identify important business processes in the organization

Comment: *

Name: *

Email: *

Verification: *

The objective of aligning mitigating controls to risk appetite is to ensure that:

• A.exposures are reduced only for critical business systems
• B.the cost of controls does not exceed the expected loss.
• C.insurance costs are minimized
• D.exposures are reduced to the fullest extent

Comment: *

Name: *

Email: *

Verification: *

Which of the following are the common mistakes while implementing KRIs?
Each correct answer represents a complete solution. Choose three.

• A.Choosing KRIs that are difficult to measure
• B.Choosing KRIs that has high correlation with the risk
• C.Choosing KRIs that are incomplete or inaccurate due to unclear specifications
• D.Choosing KRIs that are not linked to specific risk
• E.Explanation:
  A common mistake when implementing KRIs other than selecting too many KRIs includes choosing KRIs that are: Not linked to specific risk Incomplete or inaccurate due to unclear specifications Too generic Difficult to aggregate, compare and interpret Difficult to measure

Comment: *

Name: *

Email: *

Verification: *