CISA IT Risk Management 2

Question 1

Which risk treatment option involves transferring the financial consequences of a risk to a third party?

Accepted Answer

Risk transfer

Answer

Risk avoidance

Answer

Risk mitigation

Answer

Risk acceptance

Question 2

A CISA auditor finds that a company's risk register has not been updated in 18 months. What is the PRIMARY concern?

Accepted Answer

Emerging risks may not be identified or monitored

Answer

The risk register format may be outdated

Answer

The audit trail is incomplete

Answer

Risk owners have not been assigned

Question 3

In IT risk management, what does 'residual risk' refer to?

Accepted Answer

Risk remaining after controls are applied

Answer

Risk that has been fully eliminated

Answer

Risk transferred to a third party

Answer

Risk identified but not yet assessed

Question 4

Which of the following BEST describes the purpose of a risk appetite statement?

Accepted Answer

To define the level of risk the organization is willing to accept

Answer

To list all identified risks in the organization

Answer

To assign risk owners to each identified risk

Answer

To document risk mitigation strategies

Question 5

An organization uses Key Risk Indicators (KRIs). What is the PRIMARY purpose of KRIs?

Accepted Answer

To provide early warning signals of increasing risk exposure

Answer

To measure the effectiveness of IT controls after an incident

Answer

To document risk scenarios for audit purposes

Answer

To replace the need for a formal risk assessment

Question 6

Which risk assessment approach assigns numerical values to the likelihood and impact of risks to calculate an overall risk score?

Accepted Answer

Quantitative risk assessment

Answer

Qualitative risk assessment

Answer

Delphi technique

Answer

Control self-assessment

Question 7

When performing an IT risk assessment, what does 'threat likelihood' measure?

Accepted Answer

The probability that a threat will exploit a vulnerability

Answer

The potential damage a threat could cause if it occurs

Answer

The cost of implementing a control to prevent the threat

Answer

The number of assets exposed to the threat