CRISC Risk and Control Monitoring and Reporting Practice Test 4 — 15 Questions

Question 1

Match each information security objective to its description.

Question 2

A risk manager notices that a key risk indicator (KRI) for network downtime has been steadily increasing over the past three months. The current value is 15% above the risk tolerance threshold. Which of the following is the BEST immediate action?

Accepted Answer

Alert the risk owner and initiate a root cause analysis. Option C is correct because the KRI has exceeded the risk tolerance threshold, indicating a potential control failure or emerging threat. The immediate action is to alert the risk owner, who has accountability for the risk, and initiate a root cause analysis to identify why network downtime is increasing. This aligns with the CRISC process of monitoring KRIs and escalating when thresholds are breached.

Answer

Lower the risk tolerance threshold to trigger more frequent alerts

Answer

Accept the increased risk without further analysis because the trend is gradual

Answer

Increase the risk tolerance threshold to match the current level

Question 3

A control monitoring system generates an alert when transaction volumes exceed 10,000 per hour. Recently, the system has been generating false positives during peak business hours due to legitimate seasonal spikes. Which of the following is the BEST approach to reduce false positives while maintaining effective monitoring?

Accepted Answer

Apply dynamic thresholding that adjusts based on historical baseline. Option B is correct because dynamic thresholding adjusts based on historical baseline, reducing false positives during predictable spikes. Option A is wrong because manual review is inefficient and does not address the root cause. Option C is wrong because increasing threshold may miss true anomalies during normal periods. Option D is wrong because disabling alerts would eliminate monitoring entirely.

Answer

Disable the alerting during peak hours

Answer

Implement manual review of all alerts during peak hours

Answer

Increase the alert threshold to 15,000 transactions per hour

Question 4

An organization uses a risk appetite statement that limits operational losses to $2 million per quarter. A new risk reporting dashboard shows that current operational losses are $1.8 million with two weeks remaining in the quarter. The head of risk management wants to ensure that losses remain within appetite. Which of the following control monitoring reports would be MOST useful for proactive decision-making?

Accepted Answer

A projected loss report based on current trends and remaining period. Option D is correct because a projected loss report using trend analysis enables proactive action. Option A is wrong because a historical report is backward-looking. Option B is wrong because a KRI summary by category is too granular and may not show the overall projected trajectory. Option C is wrong because loss per business unit does not provide a consolidated projection against appetite.

Answer

A report on current loss amounts per business unit

Answer

A summary of historical operational losses by month

Answer

A detailed KRI report showing loss frequency by category

Question 5

Which of the following is the BEST practice for determining the frequency of control monitoring activities?

Accepted Answer

Align monitoring frequency with risk level and control effectiveness assessment. Option C is correct because monitoring frequency should be based on risk level and control effectiveness. Option A is wrong because fixed intervals ignore risk changes. Option B is wrong because monitoring only after incidents is reactive. Option D is wrong because regulatory requirements are a minimum, not necessarily optimal.

Answer

Standardize all controls to quarterly monitoring

Answer

Monitor only after a control failure is detected

Answer

Set frequency based solely on regulatory minimum requirements

Question 6

A company has implemented an automated control monitoring system that generates alerts when transactions exceed predefined thresholds. The system has been in production for six months. The risk team notices that the number of alerts has been decreasing, while actual control failures have remained constant. Which of the following is the MOST likely cause?

Accepted Answer

The data feed from transaction systems has degraded, causing missing data. Option B is correct because degradation of data feeds could cause the system to miss transactions, leading to fewer alerts. Option A is wrong because increased automation typically increases detection. Option C is wrong because if controls were improved, actual failures would decrease. Option D is wrong because employees gaming the system would likely increase failures, not keep them constant.

Answer

Employees have learned to bypass the monitoring system

Answer

The control effectiveness has improved significantly

Answer

The thresholds were automatically adjusted to be more restrictive

Question 7

A risk committee receives a monthly risk report that includes a heat map of inherent risk ratings and a separate list of control deficiencies. The committee members often complain that they cannot easily see which control deficiencies are most critical to address. Which of the following is the BEST improvement to the reporting?

Accepted Answer

Overlay control deficiency impact ratings onto the residual risk heat map. Option D is correct because combining control deficiency impact ratings with residual risk ratings directly shows the effect on risk levels. Option A is wrong because adding all KRIs may overload the report. Option B is wrong because past audit findings may be outdated. Option C is wrong because a chronological log does not prioritize by risk impact.

Answer

Include a comprehensive list of all key risk indicators (KRIs)

Answer

Provide a separate section on recent audit findings

Answer

Add a timeline of when each control deficiency was first identified

Question 8

An organization uses control self-assessments (CSAs) as part of its monitoring program. The results from the latest CSA show that the majority of controls are rated as effective, but an internal audit reveals several control failures in those same areas. What is the MOST likely reason for this discrepancy?

Accepted Answer

CSA respondents may have a bias toward reporting favorable results. Option A is correct because CSAs may be biased if self-assessed by control owners. Option B is wrong because documentation errors would affect both. Option C is wrong because inherent risk changes would not affect control effectiveness assessment. Option D is wrong because the scope of CSA is typically broader, not narrower.

Answer

The CSA scope was narrower than the audit scope

Answer

The CSA questionnaire contained documentation errors

Answer

The inherent risk level of the processes decreased after the CSA

Question 9

A company relies on a third-party cloud provider for critical data processing. As part of its vendor risk management program, the company wants to implement continuous monitoring of the provider's controls. Which of the following is the BEST approach?

Accepted Answer

Obtain and review the provider's SOC 2 Type II report on an ongoing basis. Option C is correct because SOC 2 reports provide independent assurance over controls like security and availability. Option A is wrong because annual penetration tests do not cover all controls continuously. Option B is wrong because SLAs typically measure performance, not control effectiveness. Option D is wrong because manual attestation is less reliable and not continuous.

Answer

Monitor the provider's service level agreements (SLAs) for uptime

Answer

Conduct monthly manual attestation surveys with the provider

Answer

Require the provider to perform quarterly penetration tests

Question 10

A multinational organization uses multiple risk management systems that do not integrate with each other. The risk team manually consolidates data into a spreadsheet for reporting. This process is error-prone and time-consuming. Which of the following is the BEST long-term solution to improve risk monitoring and reporting?

Accepted Answer

Implement a centralized governance, risk, and compliance (GRC) platform with automated data feeds. Option B is correct because implementing a centralized GRC platform with data feeds from all systems automates integration and reduces errors. Option A is wrong because simply adding more manual reviews increases overhead. Option C is wrong because standardizing spreadsheets still requires manual consolidation. Option D is wrong because training does not address the system integration issue.

Answer

Standardize the spreadsheet format across all departments

Answer

Train risk owners on how to better manually report risks

Answer

Assign dedicated staff to perform additional manual reviews of the spreadsheet

Question 11

A risk manager is evaluating the effectiveness of a set of key risk indicators (KRIs). Which TWO of the following are characteristics of effective KRIs?

Accepted Answer

They are quantifiable and based on reliable data. Options B and D are correct. Effective KRIs should be predictive (leading) and quantifiable. Option A is wrong because lagging indicators are less useful for proactive management. Option C is wrong because complex KRIs are difficult to communicate and monitor. Option E is wrong because narrow scope may miss broader risks.

Answer

They are complex and difficult to measure

Answer

They are lagging indicators that reflect past events

Answer

They focus on a very narrow aspect of risk

Question 12

An organization is designing a control monitoring program. Which THREE of the following are types of control monitoring activities that should be included?

Accepted Answer

Periodic internal audits of control processes. Options A, C, and D are correct. Control monitoring includes continuous monitoring (A), periodic audits (C), and control self-assessments (D). Option B is wrong because penetration testing is a point-in-time assessment, not a distinct type of monitoring activity. Option E is wrong because risk appetite is a boundary, not a monitoring activity.

Answer

Defining risk appetite statements

Answer

Penetration testing of critical systems

Question 13

Which TWO of the following are best practices for risk reporting to senior management?

Accepted Answer

Provide actionable recommendations based on risk trends. Options A and D are correct. Reporting should highlight key risk areas (A) and provide actionable insights (D). Option B is wrong because overwhelming amount of data obscures key messages. Option C is wrong because senior management needs aggregated summaries. Option E is wrong because reporting should address management's risk appetite.

Answer

Avoid discussing risk appetite to prevent confusion

Answer

Present detailed technical analysis for every risk

Answer

Include all available risk data for transparency

Question 14

The exhibit shows a log entry from a GRC system. Which of the following is the MOST significant concern regarding this risk score update?

Accepted Answer

The control effectiveness status was not updated alongside the risk score. Option B is correct because the control effectiveness status was not updated, which is critical for accurate residual risk calculation. Option A is wrong because inherent risk can change due to mitigation. Option C is wrong because the comment provides a plausible reason. Option D is wrong because the risk owner is identified.

Answer

The inherent risk score decreased without any change in the business environment

Answer

The comment does not provide sufficient detail on the mitigation project

Answer

The risk owner was not notified of the change

Question 15

The exhibit shows a warning from a control monitoring system. Based on the log, which of the following is the MOST likely control deficiency?

Accepted Answer

There is no approver assigned for transactions exceeding the limit. Option C is correct because the warning indicates that a transaction exceeded the approval limit without an assigned approver, meaning the control is not being executed. Option A is wrong because the threshold was set at 50000. Option B is wrong because the log shows the user, but the control deficiency is lack of approval. Option D is wrong because the system is working by generating the alert.

Answer

The threshold of 50000 USD is set too high

Answer

The monitoring system is generating false positives

Answer

The user JSmith should not have authority to initiate such transactions