hardMultiple Choice
CRISC Practice Question: A multinational organization uses multiple risk…
A multinational organization uses multiple risk management systems that do not integrate with each other. The risk team manually consolidates data into a spreadsheet for reporting. This process is error-prone and time-consuming. Which of the following is the BEST long-term solution to improve risk monitoring and reporting?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a centralized governance, risk, and compliance (GRC) platform with automated data feeds
Implementing a centralized GRC platform with data feeds from all systems automates integration and reduces errors. Option A is wrong because standardizing spreadsheets still requires manual consolidation. Option C is wrong because training does not address the system integration issue. Option D is wrong because simply adding more manual reviews increases overhead.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Standardize the spreadsheet format across all departments
Why it's wrong here
A common spreadsheet format eases reading but leaves the underlying systems non-integrated, so data is still copied by hand and remains error-prone. Standardised templates are the right answer when sources already integrate and only presentation differs, not when consolidation itself is the manual, failing step.
- ✓
Implement a centralized governance, risk, and compliance (GRC) platform with automated data feeds
Why this is correct
A centralised GRC platform with automated feeds removes the manual spreadsheet consolidation that causes errors and delay, directly addressing the fragmented, non-integrated systems named in the stem. Automated data ingestion gives continuous, consistent risk monitoring and reporting across the multinational estate, which point fixes to individual systems cannot achieve.
- ✗
Train risk owners on how to better manually report risks
Why it's wrong here
Training risk owners to report manually leaves the fragmented, non-integrated systems untouched, so consolidation stays error-prone and time-consuming. It is tempting because better human input genuinely improves data quality within a single system, but the stem demands a long-term architectural fix, not a procedural workaround.
- ✗
Assign dedicated staff to perform additional manual reviews of the spreadsheet
Why it's wrong here
Adding reviewers to check the spreadsheet treats the symptom, not the cause: the disconnected systems still require manual consolidation, so errors persist and effort scales with volume. Dedicated review staff suit high-stakes, low-volume reporting where automation is genuinely infeasible, not a recurring multinational aggregation process.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 1,062-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.