CRISC Risk Response and Reporting Practice Question
Which THREE of the following are components of an effective IT risk reporting structure for a large enterprise? (Select THREE)
⚠ Common exam trap
It's easy for candidates to confuse the frequency and audience for risk reporting, assuming that more frequent reporting to higher levels is always better, when in fact the board needs less frequent, strategic summaries and operational staff need more frequent, detailed updates.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Strategic risk reporting to the board on a semi-annual basis
Strategic risk reporting to the board on a semi-annual basis is correct because the board requires high-level, aggregated risk information that aligns with enterprise strategy and risk appetite. Semi-annual reporting provides sufficient frequency for oversight without overwhelming the board with operational details, as mandated by governance frameworks like COBIT and ISO 31000.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Strategic risk reporting to the board on a semi-annual basis
Why this is correct
Strategic reporting provides high-level risk information for governance.
- ✓
Tactical risk reporting to the CISO on a quarterly basis
Why this is correct
Tactical reporting supports decision-making at the senior IT leadership level.
- ✗
Annual risk reporting to IT operational staff
Why it's wrong here
Operational staff need more frequent updates than annually.
- ✗
Daily risk reporting to the board
Why it's wrong here
Daily reporting is too frequent for the board and not practical.
- ✓
Operational risk reporting to IT management on a weekly basis
Why this is correct
Operational reporting provides detailed, frequent updates for day-to-day management.
Go deeper
Related to this question
About these practice questions
One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.