CISM Information Security Risk Management Practice Question
An information security manager is updating the organization's risk register after a significant change in the threat landscape. The manager needs to ensure the register remains a useful tool for decision-making. Which TWO of the following activities are MOST important for maintaining the risk register's effectiveness? (Choose two.)
⚠ Common exam trap
The trap here is treating the risk register as a static list of technical findings rather than a living, owned, and broadly scoped governance tool.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assigning a risk owner for each entry who is accountable for treatment and monitoring
An effective risk register requires ongoing maintenance through scheduled and event-driven reviews, and clear assignment of risk owners who are accountable for treatment and monitoring. These two practices ensure the register stays current, actionable, and aligned with governance requirements. Removing accepted risks, restricting access, or limiting entries to technical vulnerabilities would reduce its value and completeness.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Limiting access to the risk register to only the information security team
Why it's wrong here
Restricting access to only the security team reduces the register's usefulness for business decision-making. Risk management is a cross-functional activity, and relevant stakeholders—such as business owners, legal, and compliance—need visibility into risks affecting their areas. Appropriate access controls should protect sensitive data, but broad exclusion hinders collaboration and informed decision-making.
- ✓
Assigning a risk owner for each entry who is accountable for treatment and monitoring
Why this is correct
Assigning a risk owner establishes clear accountability for managing each risk. The owner ensures that treatment plans are executed, residual risk is monitored, and status is reported. Without ownership, risks may languish without action or oversight. This is a fundamental requirement for an effective risk register and supports governance and auditability.
- ✓
Reviewing and updating risk entries on a defined schedule and upon significant changes
Why this is correct
Regular reviews and event-driven updates keep the risk register current and relevant. Threats, vulnerabilities, and business context change over time, so a static register quickly becomes obsolete. Scheduled reviews ensure consistency, while updates triggered by significant changes—such as new threats or system modifications—allow timely adjustments to risk ratings and treatment plans. This maintains the register's value as a decision-support tool.
- ✗
Populating the register exclusively with technical vulnerabilities identified by scanners
Why it's wrong here
A risk register should encompass a broad range of risks, including strategic, operational, compliance, and third-party risks, not just technical vulnerabilities. Focusing solely on scanner findings provides an incomplete view of the risk landscape and may miss significant business risks. The register must reflect the organization's full risk profile to support effective prioritization and treatment.
- ✗
Removing all risks that have been accepted by senior management to reduce clutter
Why it's wrong here
Accepted risks must remain in the register because they still require monitoring and periodic reassessment. Removing them would obscure the organization's total risk exposure and could lead to a false sense of security. The register should document the acceptance decision, rationale, and review date, not delete the entry. Maintaining accepted risks supports transparency and regulatory compliance.
Go deeper
Related to this question
About these practice questions
One of 924 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.