CISA IT Risk Management 4

Question 1

Which role is PRIMARILY responsible for accepting residual risk within an organization?

Accepted Answer

Risk owner or senior management

Answer

Risk acceptance is a management decision and must be made by the appropriate risk owner or senior management with the authority to do so.

Question 2

A third-party vendor has access to sensitive customer data. Which risk management activity is MOST critical?

Accepted Answer

Performing vendor risk assessments and due diligence reviews

Answer

Third-party access requires formal vendor risk assessments to evaluate whether the vendor's controls adequately protect the organization's data.

Question 3

Which of the following BEST represents the relationship between risk tolerance and risk appetite?

Accepted Answer

Risk appetite sets the strategic boundary; risk tolerance defines acceptable deviation from it

Answer

Risk appetite is the overall level of risk an organization is willing to pursue, while risk tolerance is the acceptable variance around that appetite for specific risks.

Question 4

An IS auditor is reviewing IT risk management practices. Which finding represents the MOST significant control gap?

Accepted Answer

Risk scenarios are not linked to specific business processes

Answer

Risk scenarios disconnected from business processes cannot be properly prioritized or mitigated because their business impact is unknown.

Question 5

What is the MAIN advantage of using a risk scenario approach in IT risk management?

Accepted Answer

It provides concrete, realistic examples that link threats to business impact

Answer

Risk scenarios describe specific threat events and their potential business consequences, making abstract risks tangible and easier to assess.

CISA - Certified Information Systems Auditor Practice Test

CISA - Certified Information Systems Auditor Practice Test

CISA IT Risk Management 4