CRISC Risk Response and Reporting Practice Question
An IT risk report for the board of directors should primarily focus on:
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Top risks, trends, and control performance metrics
Strategic risk reporting to the board should highlight top risks, trends, and high-level metrics in business terms, avoiding excessive technical detail.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Specific control failures with root cause analysis
Why it's wrong here
Root cause analysis is tactical, not strategic.
- ✗
Detailed technical vulnerability scan results
Why it's wrong here
Technical details are not appropriate for board-level reporting.
- ✗
Operational incident counts
Why it's wrong here
Operational incident counts provide a lagging indicator of security events, but the board requires a forward-looking risk posture assessment that aligns with business objectives and risk appetite. This metric fails to convey residual risk levels or control effectiveness, which are the board’s primary concern. It is tempting because incident counts are concrete and easily tracked in security operations centres, and would be correct for an operational review of security team performance rather than a strategic risk report.
- ✓
Top risks, trends, and control performance metrics
Why this is correct
These provide a strategic overview for the board.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 983-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.