CISM Information Security Risk Management Practice Question
A global financial services firm uses a Monte Carlo simulation model to quantify the potential financial impact of cyber events. The model inputs include historical loss data, threat intelligence, and control effectiveness. Over the past year, the model has consistently underestimated actual losses by an average of 40%. The risk manager suspects model risk but the quantitative team argues the model is peer-reviewed. The board is concerned about the accuracy of risk reporting. What is the best course of action for the risk manager?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Perform a comprehensive model validation and sensitivity analysis
Performing model validation and sensitivity analysis will help identify assumptions, data quality, or structural issues causing the underestimation. Option B is incorrect because increasing risk appetite does not address the model error; it could mask the problem. Option C is incorrect because abandoning a quantitative model for qualitative may lose objectivity, though it could be considered if model risk cannot be reduced. Option D is incorrect because simply adjusting parameters to match past incidents overfits and may not predict future losses accurately.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Perform a comprehensive model validation and sensitivity analysis
Why this is correct
Correct; this identifies flaws in the model and ensures reliability.
- ✗
Increase the risk appetite to accommodate the underestimation
Why it's wrong here
Incorrect; this does not fix the model and may lead to inadequate risk coverage.
- ✗
Replace the quantitative model with a qualitative risk assessment
Why it's wrong here
Incorrect; qualitative may not provide the precision needed for financial reporting.
- ✗
Adjust the model parameters to align with observed losses
Why it's wrong here
Incorrect; this could lead to overfitting and does not address root cause.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 871-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.