CISA IT Risk Management 5

Question 1

Which of the following is the MOST effective way to ensure IT risks are aligned with business strategy?

Accepted Answer

Integrating IT risk management into enterprise risk management (ERM)

Answer

Integrating IT risk management into ERM ensures that technology risks are evaluated in the context of overall business objectives and risk appetite.

Question 2

A CISA auditor notes that management consistently accepts risks without documented justification. What is the PRIMARY concern?

Accepted Answer

Risk acceptance decisions lack accountability and auditability

Answer

Undocumented risk acceptance decisions cannot be audited or reviewed, undermining governance and accountability.

Question 3

What is the MAIN purpose of a Business Impact Analysis (BIA) in the context of IT risk management?

Accepted Answer

To determine the criticality of business processes and recovery priorities

Answer

A BIA identifies which business processes are most critical, helping prioritize IT risk management and recovery efforts accordingly.

Question 4

An organization implements a new cloud platform. At which stage of the IT lifecycle should risk assessment FIRST occur?

Accepted Answer

During the planning and design phase

Answer

Risk assessment should occur during planning and design so that controls can be built in from the start, reducing the cost and effort of remediation later.

Question 5

Which metric BEST measures the effectiveness of an IT risk management program over time?

Accepted Answer

Reduction in residual risk levels across the risk register

Answer

Tracking reductions in residual risk levels directly measures whether the risk management program is achieving its goal of lowering actual risk exposure.

CISA - Certified Information Systems Auditor Practice Test

CISA - Certified Information Systems Auditor Practice Test

CISA IT Risk Management 5