Risk and Control Monitoring and Reporting Flashcards
6 cards from real CRISC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Risk and Control Monitoring and Reporting flashcards as text
What is risk reporting frequency typically based on?
Answer: The criticality of the risks being monitored and the requirements of the intended audience
Reporting frequency should be proportional to risk severity — critical risks may require daily monitoring while lower-priority risks might only need quarterly reviews.
What does 'three lines of defense' refer to in risk management?
Answer: Business operations, risk management/compliance, and internal audit as three distinct layers of oversight
The three lines of defense model assigns risk responsibilities to: (1) business operations, (2) risk and compliance functions, and (3) internal audit as independent assurance.
What is the primary purpose of exception reporting in IT risk management?
Answer: To immediately highlight instances where risk or control metrics fall outside acceptable thresholds
Exception reporting focuses management attention on deviations from expected performance, ensuring that issues requiring action are visible and not buried in routine reports.
Which metric best indicates the timeliness of risk response actions?
Answer: Mean Time to Remediate (MTTR) for identified control deficiencies
MTTR measures how long it takes to fix control deficiencies after they are identified, indicating whether the organization is responding to risks in a timely manner.
What is the benefit of using automated tools for risk monitoring?
Answer: They enable continuous, real-time detection of control failures and risk threshold breaches at scale
Automated monitoring tools can track thousands of data points continuously, providing immediate alerts when conditions indicate elevated risk or control failures.
Why is it important for risk reports to be tailored to the audience?
Answer: Different stakeholders need different levels of detail and framing to make informed decisions about risk
Board members need strategic summaries while IT operations teams need technical details — the same risk information must be framed differently to drive appropriate action at each level.