CRISC Information Technology and Security Practice Question
An organization is reviewing its IT risk management program and identifies that the risk register is not being updated after project changes. Which TWO components of the risk management program are most likely deficient?
⚠ Common exam trap
The trap here is that candidates see the risk register is not being updated and immediately select it as deficient, but the question asks for the components of the program that are most likely deficient—the register is the output, not the process component; the deficiency is in the policy that mandates updates and the reporting that communicates changes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Risk management policy
The risk management policy (B) is deficient because it should mandate periodic updates to the risk register after project changes, ensuring alignment with the organization's risk appetite and tolerance. Without a policy that explicitly requires post-change risk reassessment, the process lacks governance and accountability. Risk reporting (C) is also deficient because it fails to communicate the updated risk status to stakeholders, which is critical for informed decision-making and maintaining an accurate risk posture.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Risk register
Why it's wrong here
The register itself is the output; the deficiency is in the process.
- ✓
Risk management policy
Why this is correct
The policy should mandate regular updates; its absence leads to outdated registers.
- ✓
Risk reporting
Why this is correct
Reporting should drive updates; if reports are not required, registers may become stale.
- ✗
Risk assessment methodology
Why it's wrong here
Methodology defines how to assess risk, not necessarily update frequency.
- ✗
Risk treatment process
Why it's wrong here
Treatment process focuses on mitigation, not register updates.
Go deeper
Related to this question
About these practice questions
One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.