Risk Optimization

When reporting IT risk to the board, which of the following provides the most value?

Which of the following is the primary purpose of a Key Risk Indicator (KRI)?

An enterprise is evaluating the trade-off between the cost of risk mitigation and the potential business benefit. Which framework or approach should the practitioner use?

What is the most effective way to ensure that IT risk management is integrated with enterprise risk management (ERM)?

An IT project is identified as having a high inherent risk that exceeds the board-approved appetite. The project is critical for competitive advantage. Which approach is most appropriate?

An organization is transitioning to a cloud-based infrastructure. Which governance mechanism is most effective for ensuring that the cloud service provider's risk management practices remain aligned with the enterprise's risk appetite?

During an IT governance board meeting, the CGEIT practitioner notices that the current risk profile deviates significantly from the approved risk appetite. What is the most appropriate next step?

An enterprise is aligning its IT risk appetite with corporate strategic objectives. Which action should the CGEIT-certified practitioner prioritize first?

When assessing the impact of a risk, what is the best perspective to take?

A company is using a risk maturity model to improve its IT risk management. What is the main benefit?

Which role is typically responsible for the final acceptance of IT risks at the enterprise level?

An enterprise is adopting an agile development methodology. How should the CGEIT-certified practitioner modify the risk governance process?

A company is performing a risk assessment of a new software vendor. Which factor is most relevant for the governance of third-party risk?

An organization's risk appetite has been set as 'low' for data breaches. A new project introduces a moderate risk of a breach. What is the most appropriate governance action?

The board of directors requests a summary of the current IT risk posture. Which documentation should the practitioner use as the primary source?

An enterprise is facing a high-impact risk that cannot be fully mitigated. The board decides to transfer this risk. Which of the following is the best implementation of risk transfer?

Why is it important to define risk appetite before developing a risk response plan?

A company is conducting a risk analysis. Which of the following is an example of an 'inherent risk'?

Which of the following is a key component of an effective IT risk management policy?

An IT project is failing to deliver promised business value. What is the most likely governance failure?

A company is establishing an IT Risk Committee. Which group should have the most significant representation?

An IT audit reveals that risk mitigation activities are being performed, but they are not being tracked. What is the governance risk?

An enterprise is adopting a 'Risk-Based Approach' to IT governance. How should this impact the IT budget allocation?

When a risk event occurs, what is the first step in the incident response process from a governance perspective?

What is the relationship between 'IT Risk' and 'Enterprise Risk'?

Which metric is most useful for reporting the effectiveness of IT risk management to the board?

During a merger, the IT risk governance team identifies incompatible security standards. What is the correct approach?

Which TWO of the following are examples of risk mitigation?

Which TWO of the following are primary objectives of IT risk governance?

Which THREE of the following are essential components of a risk reporting framework?

Which TWO of the following are key elements of a Business Impact Analysis (BIA)?

Which THREE of the following are common risk response strategies?

Which TWO of the following factors should influence the frequency of risk reporting to the board?

Which THREE of the following represent effective ways to integrate IT risk into the organizational culture?

Which TWO of the following are examples of 'Avoidance' as a risk response?

Which THREE of the following are key inputs for defining the IT risk appetite?

Which TWO of the following describe the role of the 'Risk Owner'?

An organization is integrating IT risk management into its enterprise governance framework. Which approach best ensures that IT risk is treated as a component of enterprise risk?

A firm has decided to pursue a high-risk innovation strategy. How should the enterprise risk appetite statement be adjusted to support this goal?

You are auditing the integration of IT risk management. Which finding indicates a failure in the governance of enterprise risk?

When balancing risk and value in IT investment, what is the primary consideration for the CGEIT practitioner?

An organization experiences a high frequency of minor IT incidents. What is the most effective governance action to ensure this does not result in a significant enterprise risk?

Your organization is undergoing a major digital transformation. To ensure risk is optimized throughout the lifecycle, what is the most critical governance activity during the planning phase?

The board of directors is concerned about the impact of recent cybersecurity threats on the company's reputation. Which TWO of the following actions should the Governance committee prioritize to address these concerns?

To effectively integrate risk management into enterprise governance, which THREE activities should be conducted?

You are evaluating the maturity of your organization's risk reporting to the board. Which THREE of the following elements are essential for high-maturity reporting?