CRISC Certified in Risk and Information Systems Control

What is the primary purpose of an enterprise risk management (ERM) framework in an organization?

• ATo eliminate all business risks
• BTo provide a structured approach for managing risks across the organization
• CTo transfer all risks to third parties
• DTo comply with regulatory requirements only

Which of the following BEST describes risk appetite?

• AThe maximum amount of risk an organization can tolerate before taking action
• BThe amount and type of risk an organization is willing to pursue or retain
• CThe total value of assets at risk in the organization
• DThe probability of risk events occurring

Who is ultimately responsible for risk governance in an organization?

• AChief Information Security Officer (CISO)
• BBoard of Directors
• CChief Risk Officer (CRO)
• DInternal Audit function

What is the primary objective of the Three Lines of Defense model?

• ATo eliminate all conflicts of interest
• BTo provide clear roles and responsibilities for risk management and control
• CTo reduce the number of risk management staff
• DTo centralize all risk decisions

Which component of the COSO ERM framework focuses on the integrity and ethical values of the organization?

• ARisk Assessment
• BControl Activities
• CGovernance and Culture
• DInformation and Communication

What is risk tolerance?

• AThe maximum acceptable deviation from risk appetite
• BThe willingness to take risks
• CThe total risk exposure of the organization
• DThe budget allocated for risk management

Which of the following is a responsibility of the Chief Risk Officer (CRO)?

• AImplementing all risk controls
• BSetting the organization's risk appetite
• CDeveloping and maintaining the enterprise risk management framework
• DAuditing risk management processes

What is the primary purpose of risk policies and standards?

• ATo eliminate all risks
• BTo provide guidance and consistency for risk management activities
• CTo satisfy regulatory requirements only
• DTo assign blame when risks materialize

In the context of risk culture, what does "tone at the top" refer to?

• AThe organizational chart structure
• BThe leadership's commitment to integrity and ethical behavior
• CThe noise level in executive offices
• DThe hierarchy of risk reporting

Which compliance obligation is typically associated with SOX (Sarbanes-Oxley Act)?

• AData privacy protection
• BInternal controls over financial reporting
• CEnvironmental protection
• DWorkplace safety

What is the primary role of the first line of defense in the Three Lines of Defense model?

• AIndependent assurance on risk management
• BRisk oversight and monitoring
• COwning and managing risks in daily operations
• DRegulatory compliance reporting

Which of the following BEST describes an organization's risk capacity?

• AThe maximum amount of risk the organization can absorb without failing
• BThe risks the organization chooses to take
• CThe budget available for risk management
• DThe number of risks identified

What is the relationship between risk appetite and risk tolerance?

• AThey are identical concepts
• BRisk tolerance is more specific and measurable than risk appetite
• CRisk appetite applies only to financial risks
• DRisk tolerance is set by regulators

What is the first step in the risk assessment process?

• ARisk treatment
• BRisk identification
• CRisk monitoring
• DRisk reporting

Which technique involves creating detailed scenarios to understand how risks might materialize?

• ARisk heat map
• BScenario analysis
• CKey risk indicator
• DControl self-assessment

In risk analysis, what does "likelihood" refer to?

• AThe financial impact of a risk event
• BThe probability of a risk event occurring
• CThe speed of risk response
• DThe number of affected systems

What is a risk register?

• AA tool for logging all identified risks and their characteristics
• BA regulatory filing document
• CA list of approved risk treatments
• DAn insurance policy document

Which risk assessment technique involves gathering experts who provide input independently to avoid groupthink?

• ABrainstorming
• BDelphi technique
• CInterviewing
• DSWOT analysis

What is the purpose of risk evaluation?

• ATo eliminate all risks
• BTo compare assessed risks against risk criteria and prioritize them
• CTo implement risk controls
• DTo transfer risks to insurers

In a risk heat map, what does the position of a risk indicate?

• AThe time when the risk was identified
• BThe combination of likelihood and impact
• CThe department responsible for the risk
• DThe cost of treating the risk

What is inherent risk?

• ARisk after controls are applied
• BRisk before any controls are implemented
• CThe cost of implementing controls
• DRisk that has been transferred to a third party

What is the formula for calculating residual risk?

• AInherent risk + Control effectiveness
• BInherent risk - Control effectiveness
• CInherent risk × Control effectiveness
• DTotal risk / Number of controls

Which technique systematically examines processes to identify potential failure points?

• AScenario planning
• BFailure Mode and Effects Analysis (FMEA)
• CBenchmarking
• DControl self-assessment

What is control assessment?

• AImplementing new controls
• BEvaluating the design and operating effectiveness of existing controls
• CEliminating all controls
• DTransferring control responsibilities

Which risk treatment strategy involves taking actions to reduce the likelihood or impact of a risk?

• ARisk avoidance
• BRisk mitigation
• CRisk transfer
• DRisk acceptance

What is the primary purpose of purchasing cyber insurance?

• ATo prevent cyber attacks
• BTo transfer financial risk to the insurer
• CTo eliminate technical vulnerabilities
• DTo comply with all regulations automatically

Which risk treatment strategy involves deciding not to engage in an activity that creates risk?

• ARisk mitigation
• BRisk avoidance
• CRisk sharing
• DRisk exploitation

What is a Key Risk Indicator (KRI)?

• AA metric used to provide an early warning of increasing risk exposure
• BA type of insurance policy
• CA risk treatment strategy
• DA regulatory compliance document

When is risk acceptance an appropriate strategy?

• AWhen risk exceeds risk appetite
• BWhen the cost of treatment exceeds the potential benefit
• CWhen required by regulators
• DWhen the board refuses to act

What is the primary purpose of risk reporting?

• ATo assign blame for risk events
• BTo provide relevant risk information to decision-makers
• CTo eliminate all risks
• DTo satisfy legal requirements only

Which control type is designed to detect risk events after they have occurred?

• APreventive controls
• BDetective controls
• CCorrective controls
• DDirective controls

What is control monitoring?

• AInstalling new controls
• BOngoing activities to evaluate control effectiveness over time
• CRemoving ineffective controls
• DOutsourcing control functions

Which risk response strategy involves engaging a third party to manage a portion of the risk?

• AOutsourcing
• BRisk sharing
• CRisk financing
• DAll of the above

What is the purpose of an issue management process?

• ATo prevent all issues from occurring
• BTo systematically track, manage, and resolve risk-related issues
• CTo hide problems from auditors
• DTo transfer responsibility to other departments