CRISC Risk Response and Reporting Practice Test 14 — 15 Questions

Question 1

An organization's risk register shows that a critical database containing customer records has a high inherent risk rating. Management installs database activity monitoring, enforces encryption at rest, and implements quarterly access reviews. After these actions, the risk is re-rated as medium. Which risk concept does the re-rated medium value BEST represent?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Residual risk. Residual risk is the exposure that remains after controls are applied, and it is the figure decision makers should compare against tolerance. The database started with a high inherent rating; monitoring, encryption, and periodic access reviews lowered the likelihood and impact, producing a medium residual rating. Reporting residual risk keeps the risk register meaningful and prevents the organization from funding controls for exposure that has already been mitigated.

Answer

Risk appetite

Answer

Control risk

Answer

Inherent risk

Question 2

A risk practitioner has completed a risk assessment for a new cloud-based payroll platform. The business owner wants to proceed immediately because the platform will save $200,000 annually. The residual risk exceeds the organization's risk appetite, and no compensating controls are in place. Which action should the risk practitioner recommend FIRST?

Accepted Answer

Escalate the risk to the appropriate risk owner for a formal risk response decision.. Residual risk above appetite requires a formal decision by the risk owner, not by the practitioner or the business sponsor. Escalation ensures the accountable party evaluates response options and either approves mitigation, transfers the risk, avoids the initiative, or grants a documented exception. Simply accepting, controlling, or logging the risk would bypass the governance process that defines who may decide.

Answer

Accept the risk because the financial benefit outweighs the potential loss.

Answer

Document the risk in the risk register and take no further action.

Answer

Implement additional controls immediately and then inform the business owner.

Question 3

A global manufacturing company is designing its IT risk reporting program. The board has requested that reports be actionable, comparable over time, and aligned with the enterprise risk management framework. Which TWO of the following characteristics are MOST important for the IT risk reports to meet these objectives? (Choose two.)

Accepted Answer

Reports use consistent risk scoring criteria and definitions across all business units.. Actionable, comparable, and ERM-aligned reporting requires consistent risk scoring criteria and definitions so risks can be compared across units and over time. It also requires presenting risk in business context, linking technical findings to strategic objectives so the board can prioritize. Raw scan outputs and zero-residual-risk filters fail to provide meaningful governance information, and divergent local scales break comparability.

Answer

Reports include only risks that have been fully mitigated to zero residual risk.

Answer

Reports are customized for each business unit using different risk scales to reflect local priorities.

Answer

Reports are generated monthly using raw technical vulnerability scan outputs.

Question 4

A risk practitioner is preparing a quarterly report for the board risk committee. Senior management wants the report to show that IT risk is being managed within appetite, but the practitioner discovers that two critical control failures were identified three weeks ago and remediation is only 40 percent complete. Which approach best satisfies the practitioner's reporting obligation?

Accepted Answer

Report the failures with their current remediation status, the residual risk exposure, and an expected completion date.. Risk reporting must give governance bodies a timely, accurate view of material exposures and the status of treatment. Disclosing the control failures along with remediation progress, residual risk, and an expected completion date lets the risk committee judge appetite alignment and direct action. Suppressing or diluting the information misstates the control environment and undermines oversight.

Answer

Report only that remediation is 40 percent complete, without describing the underlying failures or their impact.

Answer

Exclude the failures from the report because remediation is already underway and the exposure is temporary.

Answer

Report the control failures only after remediation is complete so the committee receives final, accurate information.

Question 5

A global retailer's risk committee is reviewing a proposal to transfer the financial impact of payment card fraud to an insurer through a cyber insurance policy. The policy has a $2 million retention and excludes losses caused by unencrypted cardholder data at rest. The organization's cardholder database is currently unencrypted. Which of the following is the MOST significant limitation the risk manager should highlight?

Accepted Answer

The exclusion for unencrypted cardholder data means the transfer will not respond to a loss from the current database configuration.. Transferring risk through insurance is effective only when the loss event is actually covered. An exclusion for unencrypted cardholder data at rest directly conflicts with the current state of the cardholder database, so a breach of that database would not be indemnified. The risk manager must flag this gap so the committee understands that the proposed transfer does not address the organization's most likely fraud loss scenario, and that encryption or another response is needed.

Answer

Cyber insurance cannot be used as a risk response because it does not reduce the likelihood of a fraud event.

Answer

The insurer, not the risk committee, will now own the risk and control decisions for the payment environment.

Answer

The retention amount is too low to provide meaningful financial protection for a global retailer.

Question 6

An IT risk analyst is preparing a report for the board risk committee. The committee wants a single view of how much loss the organization could face from IT risks over the next year if no additional controls are implemented. Which metric should the analyst use?

Accepted Answer

Annualized loss expectancy (ALE). The board requested a single monetary view of potential annual loss from IT risks with no additional controls, which is precisely what annualized loss expectancy provides. ROSI is a control-investment metric, control deficiency rate measures control performance, and RTO is a time-based recovery target. Only ALE combines likelihood and financial impact into an expected annual loss figure suitable for board-level risk reporting.

Answer

Return on security investment (ROSI)

Answer

Recovery time objective (RTO)

Answer

Control deficiency rate

Question 7

A multinational bank must report technology risk to its board risk committee each quarter. The committee has asked the risk team to strengthen the reporting so it drives decisions rather than just describing activity. Which TWO of the following changes would BEST achieve that objective? (Choose two.)

Accepted Answer

Add trend analysis showing how key risk indicators have moved against their thresholds over several reporting periods.. Reporting that drives decisions must connect metrics to the limits leadership approved and show direction over time. Trend analysis against thresholds and breach status against appetite both give the committee a basis to act, such as approving remediation funding or accepting a documented exception. Expanded narratives, more metrics, or delegated authorship add volume or shift perspective without improving the committee's ability to decide.

Answer

Include a longer narrative describing every control test performed during the quarter.

Answer

Delegate the entire board report to the IT operations manager to reduce preparation time.

Answer

Increase the number of metrics reported from twenty to sixty to provide more coverage.

Question 8

A healthcare provider has identified a risk that a critical medical imaging system runs on an unsupported operating system. The risk owner determines that the residual risk exceeds the organization's risk appetite, but upgrading the system would cost $2 million and disrupt patient care for several weeks. Which of the following is the MOST appropriate next step?

Accepted Answer

Escalate the risk to the appropriate governance body with options and recommendations for a risk response decision.. When residual risk exceeds the organization's risk appetite, the risk owner must escalate to the governance body empowered to make risk response decisions. That body can weigh the $2 million upgrade cost and patient care disruption against the security exposure, and choose among options such as phased remediation, compensating controls, or formal risk acceptance. Unilateral acceptance, silent closure, or insurance-only responses bypass required governance.

Answer

Transfer the risk by purchasing cyber insurance and take no other action.

Answer

Accept the risk because patient care disruption outweighs the security risk.

Answer

Implement a compensating control and close the risk without further reporting.

Question 9

A multinational retailer operates in a jurisdiction that requires all payment data to remain within national borders. The risk practitioner is asked to verify that a newly deployed cloud payment service complies with this requirement before it goes live. Which activity best provides this assurance?

Accepted Answer

Verifying the configured data storage and processing regions and obtaining contractual commitments on data location.. Data residency obligations are satisfied only by evidence of where data actually resides plus a binding commitment that it stays there. Verifying the provisioned regions, including replication and backup locations, and securing contractual data-location terms directly addresses the regulatory requirement. General certifications and availability agreements speak to security or uptime, not geographic confinement of payment data.

Answer

Reviewing the cloud provider's publicly available service level agreement for uptime commitments.

Answer

Confirming that the provider holds a current ISO/IEC 27001 certification for its information security management system.

Answer

Obtaining the cloud provider's general SOC 2 Type II report covering security and availability.

Question 10

A healthcare provider has experienced repeated phishing incidents that led to credential compromise. The risk committee has approved a new email security control that will quarantine suspicious messages and enforce multifactor authentication. Which TWO activities are essential to validate that the control is operating effectively after implementation? (Choose two.)

Accepted Answer

Conduct periodic control testing by simulating phishing campaigns and reviewing whether messages are quarantined and MFA is enforced.. Validation of a control requires evidence that it operates as intended in the production environment. Simulated phishing tests combined with MFA enforcement checks directly exercise the control against realistic threats, while performance metrics and exception reporting provide continuous, quantifiable evidence of effectiveness. Vendor documentation, policy acknowledgment, and project delivery metrics may support the program but do not demonstrate that the control is actually working.

Answer

Review the vendor's marketing materials and SOC 2 report to confirm the product supports quarantine and MFA features.

Answer

Confirm that the project to implement the control was completed within the approved budget and schedule.

Answer

Ask employees to sign an acknowledgment that they have read the updated acceptable use policy.

Question 11

During a quarterly risk review, a risk owner reports that a critical trading application has exceeded its residual risk tolerance for the second consecutive quarter despite remediation efforts. The risk owner proposes to continue remediation and report again next quarter. Which of the following should the risk manager do?

Accepted Answer

Escalate the tolerance breach to the risk committee and recommend a formal risk response decision, such as acceptance, additional mitigation, or avoidance.. A residual risk that stays above tolerance across multiple reporting periods is a governance event, not a routine remediation update. The risk manager's role is to make the breach visible, present the evidence and available response options, and let the risk committee decide whether to accept, mitigate further, transfer, or avoid. Documenting that decision maintains accountability and keeps the organization's risk profile aligned with its stated tolerance.

Answer

Accept the risk owner's proposal because remediation is already underway and progress is being made.

Answer

Re-rate the application's residual risk to within tolerance to reflect the remediation work already completed.

Answer

Direct the risk owner to implement additional controls immediately without involving the risk committee.

Question 12

An organization has decided to purchase cyber insurance to cover potential losses from a ransomware event affecting its order-processing systems. Which risk response has the organization selected?

Accepted Answer

Risk transfer. Insurance is the classic transfer response: a premium is exchanged for the insurer's assumption of defined financial losses. The operational risk of ransomware remains with the organization, which is why transfer is often paired with mitigation. Avoidance would end the activity, mitigation would reduce likelihood or impact directly, and acceptance would retain the loss without external coverage.

Answer

Risk acceptance

Answer

Risk mitigation

Answer

Risk avoidance

Question 13

A risk practitioner is defining key risk indicators (KRIs) for the organization's third-party risk program after several supplier outages disrupted operations. Which TWO characteristics are essential for these KRIs to be effective for the risk committee? (Choose two.)

Accepted Answer

Each indicator is measurable from data that can be collected reliably and repeatedly.. Effective KRIs are measurable from reliable, repeatable data and are linked to thresholds that trigger defined action. Those two properties turn a metric into a decision-support tool for the risk committee. Activity counts, subjective ratings, and annual-only reviews lack the objectivity, relevance, and timeliness needed to warn about third-party disruption before it affects operations.

Answer

Each indicator reflects the total number of suppliers onboarded during the reporting period.

Answer

Each indicator is reviewed only during the annual enterprise risk assessment cycle.

Answer

Each indicator is expressed as a qualitative rating assigned by the relationship manager.

Question 14

A multinational manufacturer is consolidating IT risk data from business units into a single enterprise risk report for the board. The risk manager must ensure the report supports effective risk-based decision making. Which TWO of the following characteristics are MOST important for the consolidated report to include? (Choose two.)

Accepted Answer

Consistent risk rating criteria and definitions applied across all business units.. An enterprise risk report earns its value by enabling decisions, which requires two things: comparability and relevance to tolerance. Consistent rating criteria and definitions across business units make aggregated data trustworthy, while showing residual risk against approved tolerance tells the board where intervention is needed. Together they convert disparate unit-level data into a coherent enterprise view that supports prioritization, resource allocation, and formal risk acceptance decisions.

Answer

A complete inventory of every IT asset and its configured technical settings.

Answer

A forecast of IT budget spend for the next three fiscal years.

Answer

Detailed descriptions of every control deficiency identified during the reporting period.

Question 15

During a risk analysis, the risk team finds that a legacy inventory system has a single point of failure: one administrator holds the only credentials for the backup restoration process. The system supports regulatory filings with a hard deadline. Management proposes documenting the situation in the risk register and revisiting it next year. Which action should the risk practitioner take?

Accepted Answer

Escalate the concentration risk and recommend immediate interim controls such as credential escrow or a second trained administrator.. A single point of failure tied to a hard regulatory deadline and held by one person warrants prompt treatment, especially when low-cost interim measures exist. Escalating with a recommendation to escrow credentials or train a second administrator addresses availability and fraud exposure immediately while a permanent solution is designed. Deferring, blocking access, or relying solely on insurance leaves the operational and compliance risk intact.

Answer

Transfer the risk by purchasing additional cyber insurance for the inventory system.

Answer

Agree, because the risk is documented and the system still functions today.

Answer

Remove the administrator's access until a permanent solution is approved.