CRISC Risk Response and Reporting Practice Question
A multinational corporation is developing its IT risk reporting structure. The risk manager must align reports with different audiences. Which THREE of the following reporting frequencies and audiences are correctly matched?
⚠ Common exam trap
Many exam-takers confuse the appropriate audience and frequency for tactical versus strategic reporting, often assuming the board needs frequent updates, when in fact the board requires high-level, less frequent strategic reports, while operational and tactical reports are more frequent and directed to management.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Strategic risk reporting: semi-annual to the board
Strategic risk reporting, which addresses high-level enterprise risks and long-term objectives, is appropriately directed to the board of directors on a semi-annual basis. This frequency aligns with the board's oversight role and the need for periodic, aggregated risk insights without overwhelming them with operational details.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Strategic risk reporting: semi-annual to the board
Why this is correct
Strategic reports are semi-annual or annual to the board.
- ✓
Operational risk reporting: weekly to IT management
Why this is correct
Operational reports are frequent and for IT management.
- ✓
Operational risk reporting: monthly to IT management
Why this is correct
Monthly is also acceptable for operational reporting.
- ✗
Tactical risk reporting: monthly to the board
Why it's wrong here
Tactical reports are quarterly to CISO/CIO, not monthly to the board.
- ✗
Strategic risk reporting: weekly to the board
Why it's wrong here
Strategic reports are not weekly; that is too frequent.
Go deeper
Related to this question
About these practice questions
One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.