CRISC Risk Response and Reporting Practice Question
An IT risk manager is preparing a report for the board of directors. Which of the following content elements is most important for strategic risk reporting?
⚠ Common exam trap
It's easy for candidates to confuse operational reporting (e.g., vulnerability scans, control metrics) with strategic reporting, failing to recognize that the board requires a consolidated, business-aligned view of risk rather than detailed technical data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
IT risk integration with enterprise risk management
Strategic risk reporting to the board requires a high-level view that aligns IT risk with enterprise objectives. Option B is correct because it demonstrates how IT risk is integrated into the broader enterprise risk management (ERM) framework, enabling the board to understand the business impact of IT risks. This integration is essential for strategic decision-making, as it connects technical risk data to organizational goals and risk appetite.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Weekly vulnerability scan results
Why it's wrong here
Weekly results are too granular for strategic reporting.
- ✓
IT risk integration with enterprise risk management
Why this is correct
The board needs to understand how IT risk fits into the overall enterprise risk profile.
- ✗
List of all vendor risk assessments
Why it's wrong here
Vendor details are operational; only critical vendor risks may be summarized.
- ✗
Detailed control performance metrics
Why it's wrong here
For strategic risk reporting to the board, the focus must be on high-level risk exposure, trends, and business impact, not granular operational details. Detailed control performance metrics are too tactical and specific, failing to convey the aggregated risk posture that directors require for governance decisions. This option is tempting because control metrics are essential for operational risk management and compliance reporting, where they would be the correct choice for a manager assessing control effectiveness.
Go deeper
Related to this question
About these practice questions
One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.