CISM Information Security Risk Management Practice Question
A risk manager is aggregating risks across the enterprise and finds that multiple individual risks, each with low impact and low probability, could combine to create a significant risk. What is the best approach to address this?
⚠ Common exam trap
The trap here is that candidates mistakenly apply the 'low probability, low impact' rule from individual risk assessment and ignore the need for aggregation, failing to recognize that the sum of many small risks can exceed the enterprise risk tolerance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a risk aggregation model to assess cumulative impact and consider enterprise-level controls
Risk aggregation models are specifically designed to quantify the cumulative impact of multiple low-level risks that, when combined, exceed the enterprise's risk appetite. This approach aligns with the CISM domain of Information Security Risk Management, where enterprise-level controls (e.g., centralized monitoring, compensating controls) are necessary to address systemic risk that individual risk treatments cannot mitigate. The key insight is that the combined probability of correlated or cascading events may be higher than the product of individual probabilities, especially when risks share common root causes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ignore the individual risks as they are low priority
Why it's wrong here
Ignoring risks prevents proper risk management.
- ✓
Use a risk aggregation model to assess cumulative impact and consider enterprise-level controls
Why this is correct
Aggregation provides a holistic view and appropriate mitigation.
- ✗
Accept the risk because the probability of all occurring simultaneously is negligible
Why it's wrong here
The probability of combined occurrence may still be significant.
- ✗
Treat each individual risk separately with minimal controls
Why it's wrong here
This does not address the cumulative risk.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 871-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.