CRISC Risk Monitoring, Reporting, and KRIs 2

Question 1

Which activity is MOST critical to maintaining an accurate risk register over time?

Accepted Answer

Regular review and update based on changes in threats, controls, and business context

Answer

A risk register must be actively maintained by updating it as threats evolve, controls change, and business conditions shift to remain a reliable risk management tool.

Question 2

A risk dashboard that shows risks trending toward the red zone is MOST useful for which purpose?

Accepted Answer

Triggering proactive risk response before the risk reaches critical levels

Answer

A worsening trend visible on a risk dashboard gives risk owners advance warning to act before a risk breaches tolerance thresholds.

Question 3

Which metric would BEST serve as a KRI for the risk of insider data theft?

Accepted Answer

Number of employees accessing data outside normal business hours

Answer

Unusual access patterns such as off-hours data access are leading indicators of potential insider threat activity and directly correlate to insider theft risk.

Question 4

Which condition indicates that a control monitoring program is INEFFECTIVE?

Accepted Answer

Control failures are only discovered after security incidents occur

Answer

Discovering control failures only after incidents indicates monitoring is reactive rather than proactive, meaning the monitoring program has failed its purpose.

Question 5

Which element should be included in a risk exception report submitted to senior management?

Accepted Answer

The risk description, justification for exception, residual risk level, and expiration date

Answer

A risk exception report must document what the risk is, why the exception is justified, the remaining residual risk, and when the exception will be reviewed or expire.

CRISC - Certified in Risk and Information Systems Control Practice Test

CRISC - Certified in Risk and Information Systems Control Practice Test

CRISC Risk Monitoring, Reporting, and KRIs 2