Risk Governance and Frameworks Flashcards
6 cards from real CRISC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Risk Governance and Frameworks flashcards as text
Which internationally recognized framework is MOST commonly used to align IT risk governance with enterprise risk management (ERM)?
Answer: COSO ERM
COSO ERM provides an integrated framework that aligns IT risk management with broader enterprise risk governance objectives.
The THREE lines of defense model assigns IT risk oversight responsibility to which line?
Answer: Second line (risk management function)
The second line of defense — the risk management function — is responsible for overseeing and monitoring IT risk across the organization.
A risk appetite statement should PRIMARILY be approved by which organizational body?
Answer: Board of Directors
The Board of Directors is ultimately accountable for setting and approving the organization's risk appetite at the highest governance level.
Which CRISC domain focuses on ensuring that risk management activities are integrated into the enterprise governance structure?
Answer: IT Risk Governance
The IT Risk Governance domain ensures risk management is embedded in the enterprise governance structure and aligned with business objectives.
When developing a risk governance framework, which element BEST ensures accountability for risk decisions?
Answer: Defined RACI matrix for risk roles
A RACI matrix (Responsible, Accountable, Consulted, Informed) explicitly assigns accountability for each risk-related decision and activity.
Which statement BEST describes the relationship between risk tolerance and risk appetite?
Answer: Risk tolerance is the acceptable deviation from risk appetite
Risk tolerance represents the acceptable variation around the risk appetite threshold, allowing flexibility within defined boundaries.