Risk Monitoring, Reporting, and KRIs Flashcards
6 cards from real CRISC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Risk Monitoring, Reporting, and KRIs flashcards as text
A Key Risk Indicator (KRI) is BEST defined as:
Answer: A metric that signals increasing risk exposure before an incident occurs
KRIs are forward-looking metrics that provide early warning signals of increasing risk, enabling proactive management before losses occur.
Which characteristic distinguishes a HIGH-QUALITY KRI from a poorly designed one?
Answer: It is measurable, timely, and directly correlated to a specific risk
Effective KRIs must be quantifiable, available in time to act, and have a proven correlation to the risk they are monitoring.
The PRIMARY purpose of risk monitoring in the CRISC framework is to:
Answer: Detect changes in the risk environment that require updated risk responses
Risk monitoring detects environmental changes — new threats, control failures, or shifting business conditions — that may require updates to risk responses.
Which risk reporting element is MOST valuable to a board-level audience?
Answer: A summary of top risks and their alignment with risk appetite
Board members need a concise, strategic view of top risks relative to risk appetite — not granular technical details that belong in operational reporting.
A threshold breach in a KRI should MOST immediately trigger:
Answer: Escalation to the risk owner and review of the associated control
When a KRI threshold is breached, the risk owner must be notified immediately to review whether the associated controls need reinforcement or response.
Which type of risk reporting is MOST appropriate for communicating day-to-day IT risk status to operational teams?
Answer: Operational risk dashboards with real-time metrics
Operational teams need real-time or near-real-time dashboards that reflect current risk status rather than periodic strategic reports.