CISM Information Security Risk Management Practice Question
A risk manager is aggregating risks across the enterprise and finds that multiple individual risks, each with low impact and low probability, could combine to create a significant risk. What is the best approach to address this?
⚠ Common exam trap
The trap here is that candidates mistakenly apply the 'low probability, low impact' rule from individual risk assessment and ignore the need for aggregation, failing to recognize that the sum of many small risks can exceed the enterprise risk tolerance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a risk aggregation model to assess cumulative impact and consider enterprise-level controls
Risk aggregation models are specifically designed to quantify the cumulative impact of multiple low-level risks that, when combined, exceed the enterprise's risk appetite. This approach aligns with the CISM domain of Information Security Risk Management, where enterprise-level controls (e.g., centralized monitoring, compensating controls) are necessary to address systemic risk that individual risk treatments cannot mitigate. The key insight is that the combined probability of correlated or cascading events may be higher than the product of individual probabilities, especially when risks share common root causes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ignore the individual risks as they are low priority
Why it's wrong here
Ignoring low-rated risks discards them from the register, so their aggregation into a significant enterprise exposure is never evaluated or treated. Disregarding individually minor risks is defensible only when aggregation analysis confirms the combined exposure stays within appetite.
- ✓
Use a risk aggregation model to assess cumulative impact and consider enterprise-level controls
Why this is correct
A risk aggregation model quantifies cumulative impact across correlated low-likelihood, low-impact risks, exposing the combined exposure that siloed assessments miss. Enterprise-level controls then address that aggregate exposure, satisfying the stem's requirement to manage risks whose significance emerges only collectively rather than individually.
- ✗
Accept the risk because the probability of all occurring simultaneously is negligible
Why it's wrong here
Accepting on the assumption that simultaneous occurrence is negligible substitutes an untested probability judgement for aggregation analysis, which explicitly addresses correlated and cumulative exposure. Acceptance is correct only after quantified aggregation shows combined impact falls within the stated risk appetite.
- ✗
Treat each individual risk separately with minimal controls
Why it's wrong here
Treating each risk separately with minimal controls misses the cumulative exposure that aggregation revealed, because the combined impact exceeds any individual rating. Separate minimal treatment suits genuinely independent low risks whose aggregate remains within appetite.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 924-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.