CRISC Risk Response and Reporting Practice Question
In a risk report presented to the board of directors, which of the following elements is most appropriate to include?
⚠ Common exam trap
CRISC often tests the audience-appropriateness of risk reporting — candidates pick detailed operational data when the board needs strategic, aggregated risk views.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Risk heat map with top risks and status
A risk report to the board of directors should be strategic and concise, focusing on top risks and their status. A risk heat map with top risks and status provides an executive-level view that supports governance and decision-making without overwhelming the board with operational detail. This is the most appropriate element for a board audience.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Vendor security assessment scores for all vendors
Why it's wrong here
Per-vendor assessment scores are operational detail that buries the board in supplier-level data; directors need aggregated risk exposure tied to business objectives. It tempts because vendor risk genuinely matters, and such scores would be correct in a supplier risk review or third-party management committee, not a board-level report.
- ✗
Detailed weekly firewall log analysis
Why it's wrong here
Weekly firewall logs are raw technical telemetry; a board needs risk expressed in business impact and likelihood terms, not packet-level events. It tempts because firewall analysis evidences control effectiveness, and it would be correct for an operational security review or SOC metrics pack rather than a directors' risk report.
- ✗
List of all IT incidents from the past month
Why it's wrong here
An exhaustive incident list is operational reporting; the board requires aggregated risk themes, trends and residual exposure aligned to strategy. It tempts because incident volumes indicate control health, and such a list would be correct in a monthly service management review, not a board risk report.
- ✓
Risk heat map with top risks and status
Why this is correct
A risk heat map with top risks and status translates complex risk data into a visual, prioritised format that boards can act on. It satisfies the stem's board-level audience constraint by focusing on material exposures and treatment progress, rather than operational detail, enabling informed governance decisions without requiring technical depth.
About these practice questions
This CRISC question is part of Courseiva's 1,062-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.