CISM Information Security Risk Management Practice Question
A technology startup has grown rapidly and its risk management practices are informal. The CEO has a very high risk appetite and frequently overrides risk management recommendations to accelerate product launches. After a serious data breach involving customer payment information, the board of directors demands a formal risk management program. The risk manager is tasked with changing the risk culture. The startup has limited resources but must meet contractual obligations to protect customer data. What is the most effective first step?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Develop and communicate a revised risk appetite statement approved by the board
Developing and communicating a revised risk appetite statement approved by the board directly addresses the need to formalize risk management and change the risk culture. It provides clear guidance for decision-making, aligns with the board's demands, and respects the startup's limited resources by focusing on policy first. Other options are premature: deploying technical controls without policy support may be ineffective, outsourcing does not change internal culture, and terminating the CEO is an HR action that does not establish a risk program.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Develop and communicate a revised risk appetite statement approved by the board
Why this is correct
Correct; this aligns the organization's risk tolerance and guides behavior.
- ✗
Outsource all information security operations to a managed service provider
Why it's wrong here
Incorrect; outsourcing does not change internal culture and may introduce new risks.
- ✗
Immediately deploy a suite of technical security controls
Why it's wrong here
Incorrect; without cultural change, controls may be bypassed.
- ✗
Recommend the termination of the CEO for previous risk decisions
Why it's wrong here
Incorrect; this is a personnel action, not a risk management step.
Go deeper
Related to this question
About these practice questions
One of 871 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.