Risk Governance and Frameworks Flashcards

Which metric is MOST useful for evaluating the effectiveness of an IT risk governance framework?

Answer: Percentage of risks with assigned owners and response plans

Governance effectiveness is best measured by how completely risks are owned and have defined response plans, indicating accountability and readiness.

Which element of IT risk governance ensures that risk decisions are transparent and auditable?

Answer: Documentation and record-keeping of risk decisions

Documenting risk decisions creates a transparent audit trail that demonstrates accountability and supports governance review activities.

A CRISC professional advising on governance would MOST likely recommend that risk reporting frequency to the board be based on:

Answer: The significance of risks and organizational risk appetite

Board reporting frequency should be driven by the materiality of risks and how close the organization is to its risk appetite thresholds.

Which statement BEST reflects the purpose of a risk committee in IT risk governance?

Answer: To provide oversight and strategic direction for risk management activities

A risk committee provides governance-level oversight and sets strategic direction for risk management rather than performing operational activities.

When aligning IT risk governance with enterprise risk management, the FIRST step is to:

Answer: Understand the enterprise risk management framework already in place

Before aligning IT risk governance, practitioners must first understand the existing ERM framework to ensure consistent language, methodology, and objectives.

Which governance principle requires that those who own risk decisions also bear the consequences of those decisions?

Answer: Accountability

Accountability in governance means that risk decision-makers are responsible for the outcomes of their decisions, incentivizing sound risk management.