Risk Optimization

Which TWO of the following factors should influence the frequency of risk reporting to the board?

During an IT governance board meeting, the CGEIT practitioner notices that the current risk profile deviates significantly from the approved risk appetite. What is the most appropriate next step?

A company is conducting a risk analysis. Which of the following is an example of an 'inherent risk'?

Why is it important to define risk appetite before developing a risk response plan?

You are evaluating the maturity of your organization's risk reporting to the board. Which THREE of the following elements are essential for high-maturity reporting?

A firm has decided to pursue a high-risk innovation strategy. How should the enterprise risk appetite statement be adjusted to support this goal?

When assessing the impact of a risk, what is the best perspective to take?

During a merger, the IT risk governance team identifies incompatible security standards. What is the correct approach?

A company is performing a risk assessment of a new software vendor. Which factor is most relevant for the governance of third-party risk?

An IT project is identified as having a high inherent risk that exceeds the board-approved appetite. The project is critical for competitive advantage. Which approach is most appropriate?

An enterprise is aligning its IT risk appetite with corporate strategic objectives. Which action should the CGEIT-certified practitioner prioritize first?

Which metric is most useful for reporting the effectiveness of IT risk management to the board?

Which THREE of the following are key inputs for defining the IT risk appetite?

An organization's risk appetite has been set as 'low' for data breaches. A new project introduces a moderate risk of a breach. What is the most appropriate governance action?

Your organization is undergoing a major digital transformation. To ensure risk is optimized throughout the lifecycle, what is the most critical governance activity during the planning phase?

An organization is transitioning to a cloud-based infrastructure. Which governance mechanism is most effective for ensuring that the cloud service provider's risk management practices remain aligned with the enterprise's risk appetite?

Which THREE of the following are common risk response strategies?

An organization experiences a high frequency of minor IT incidents. What is the most effective governance action to ensure this does not result in a significant enterprise risk?

You are auditing the integration of IT risk management. Which finding indicates a failure in the governance of enterprise risk?

A company is establishing an IT Risk Committee. Which group should have the most significant representation?

Which TWO of the following describe the role of the 'Risk Owner'?

Which of the following is a key component of an effective IT risk management policy?

An enterprise is facing a high-impact risk that cannot be fully mitigated. The board decides to transfer this risk. Which of the following is the best implementation of risk transfer?

When balancing risk and value in IT investment, what is the primary consideration for the CGEIT practitioner?

Which TWO of the following are key elements of a Business Impact Analysis (BIA)?

Which TWO of the following are examples of 'Avoidance' as a risk response?

When reporting IT risk to the board, which of the following provides the most value?

A company is using a risk maturity model to improve its IT risk management. What is the main benefit?

To effectively integrate risk management into enterprise governance, which THREE activities should be conducted?

An organization is integrating IT risk management into its enterprise governance framework. Which approach best ensures that IT risk is treated as a component of enterprise risk?

An enterprise is adopting an agile development methodology. How should the CGEIT-certified practitioner modify the risk governance process?

Which TWO of the following are examples of risk mitigation?

An enterprise is evaluating the trade-off between the cost of risk mitigation and the potential business benefit. Which framework or approach should the practitioner use?

An enterprise is adopting a 'Risk-Based Approach' to IT governance. How should this impact the IT budget allocation?

An IT audit reveals that risk mitigation activities are being performed, but they are not being tracked. What is the governance risk?

Which THREE of the following are essential components of a risk reporting framework?

Which role is typically responsible for the final acceptance of IT risks at the enterprise level?

What is the relationship between 'IT Risk' and 'Enterprise Risk'?

Which TWO of the following are primary objectives of IT risk governance?

The board of directors is concerned about the impact of recent cybersecurity threats on the company's reputation. Which TWO of the following actions should the Governance committee prioritize to address these concerns?

When a risk event occurs, what is the first step in the incident response process from a governance perspective?

Which THREE of the following represent effective ways to integrate IT risk into the organizational culture?

What is the most effective way to ensure that IT risk management is integrated with enterprise risk management (ERM)?

Which of the following is the primary purpose of a Key Risk Indicator (KRI)?

An IT project is failing to deliver promised business value. What is the most likely governance failure?

The board of directors requests a summary of the current IT risk posture. Which documentation should the practitioner use as the primary source?