Risk and Control Monitoring and Reporting Flashcards
6 cards from real CRISC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Risk and Control Monitoring and Reporting flashcards as text
What is the primary purpose of continuous risk monitoring in CRISC?
Answer: To detect changes in the risk environment and verify that controls remain effective over time
Continuous risk monitoring ensures that the organization maintains awareness of its risk profile and quickly identifies when new risks emerge or existing controls degrade.
What is a Key Risk Indicator (KRI)?
Answer: A metric that provides early warning signals of increasing risk exposure
KRIs are forward-looking metrics designed to signal when risk levels are trending toward or beyond acceptable thresholds before an incident occurs.
How does a KRI differ from a Key Performance Indicator (KPI)?
Answer: KRIs indicate potential future risk exposure; KPIs measure current control and process performance
KRIs are predictive, warning of emerging risks, while KPIs are diagnostic, measuring how well current controls and processes are performing.
What information should a risk report to senior management typically include?
Answer: Current risk status, changes since last reporting period, KRI trends, and recommendations for action
Executive risk reports should summarize the risk landscape in business terms, highlight changes and trends, and provide actionable recommendations.
What is the purpose of a control self-assessment (CSA)?
Answer: To allow process owners to evaluate the effectiveness of controls over their own activities
CSA empowers process owners to assess whether controls in their area are operating effectively, promoting ownership and often uncovering issues before formal audits.
Which of the following indicates a control deficiency that requires immediate escalation?
Answer: A critical control has failed and the resulting risk now exceeds the organization's risk tolerance
When a failed control causes risk to exceed tolerance, immediate escalation is required because the organization is operating outside its acceptable risk boundaries.