CISA IT Risk Management 2

Question 1

Which risk treatment option involves transferring the financial consequences of a risk to a third party?

Accepted Answer

Risk transfer

Answer

Risk transfer shifts the financial burden of a risk to another party, such as through insurance or outsourcing contracts.

Question 2

A CISA auditor finds that a company's risk register has not been updated in 18 months. What is the PRIMARY concern?

Accepted Answer

Emerging risks may not be identified or monitored

Answer

A stale risk register means new and evolving threats may go unrecognized, leaving the organization exposed to unmanaged risks.

Question 3

In IT risk management, what does 'residual risk' refer to?

Accepted Answer

Risk remaining after controls are applied

Answer

Residual risk is the level of risk that remains after control measures have been implemented.

Question 4

Which of the following BEST describes the purpose of a risk appetite statement?

Accepted Answer

To define the level of risk the organization is willing to accept

Answer

A risk appetite statement articulates how much risk the board and senior management are willing to tolerate in pursuit of business objectives.

Question 5

An organization uses Key Risk Indicators (KRIs). What is the PRIMARY purpose of KRIs?

Accepted Answer

To provide early warning signals of increasing risk exposure

Answer

KRIs act as leading indicators that signal when risk levels are approaching thresholds, enabling proactive management.

CISA - Certified Information Systems Auditor Practice Test