Risk and Control Monitoring and Reporting Flashcards
6 cards from real CRISC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Risk and Control Monitoring and Reporting flashcards as text
What does a risk dashboard primarily provide to stakeholders?
Answer: A real-time or near-real-time visual summary of the organization's risk posture and KRI status
A risk dashboard aggregates KRIs and risk metrics into a visual format that enables quick understanding of the current risk posture without requiring detailed analysis.
What is the purpose of tracking risk trends over time?
Answer: To identify whether risks are increasing, decreasing, or stable so that responses can be adjusted accordingly
Trend analysis reveals the direction risk is moving, enabling proactive adjustments to risk responses before situations deteriorate beyond acceptable thresholds.
Which of the following is a typical trigger for updating the risk register?
Answer: A significant change in the business environment, technology, or threat landscape
Material changes in the environment — such as new systems, mergers, emerging threats, or regulatory changes — should trigger an update to the risk register to keep it current.
What is the significance of establishing control thresholds in risk monitoring?
Answer: Thresholds define the acceptable performance range for controls, triggering alerts when breached
Control thresholds define the boundary of acceptable performance; when a metric crosses the threshold, it signals that human review and potential escalation are needed.
What is the purpose of a lessons-learned review after a security incident?
Answer: To analyze what happened, why controls failed, and how to prevent recurrence
Lessons-learned reviews close the risk management loop by identifying root causes, control weaknesses, and improvements to prevent the same incident from recurring.
What role does internal audit play in the risk monitoring process?
Answer: Providing independent assurance that risk management processes and controls are operating effectively
Internal audit provides objective, independent validation that the risk management framework and controls are functioning as intended, without conflicts of interest.