Risk Monitoring, Reporting, and KRIs Flashcards

Which activity is MOST critical to maintaining an accurate risk register over time?

Answer: Regular review and update based on changes in threats, controls, and business context

A risk register must be actively maintained by updating it as threats evolve, controls change, and business conditions shift to remain a reliable risk management tool.

A risk dashboard that shows risks trending toward the red zone is MOST useful for which purpose?

Answer: Triggering proactive risk response before the risk reaches critical levels

A worsening trend visible on a risk dashboard gives risk owners advance warning to act before a risk breaches tolerance thresholds.

Which metric would BEST serve as a KRI for the risk of insider data theft?

Answer: Number of employees accessing data outside normal business hours

Unusual access patterns such as off-hours data access are leading indicators of potential insider threat activity and directly correlate to insider theft risk.

Which condition indicates that a control monitoring program is INEFFECTIVE?

Answer: Control failures are only discovered after security incidents occur

Discovering control failures only after incidents indicates monitoring is reactive rather than proactive, meaning the monitoring program has failed its purpose.

Which element should be included in a risk exception report submitted to senior management?

Answer: The risk description, justification for exception, residual risk level, and expiration date

A risk exception report must document what the risk is, why the exception is justified, the remaining residual risk, and when the exception will be reviewed or expire.

The concept of 'risk-based monitoring' means that monitoring intensity should be:

Answer: Proportional to the significance of the risk being monitored

Risk-based monitoring concentrates resources on higher-risk areas, ensuring that the most significant risks receive the most frequent and rigorous monitoring.