GRC Enterprise Risk Management Frameworks 3

Question 1

Which of the following best describes a 'Key Risk Indicator' (KRI) in ERM?

Accepted Answer

A forward-looking metric that signals increasing risk exposure

Answer

KRIs are early-warning metrics that signal potential risk increases before a loss event occurs, enabling proactive management.

Question 2

In the NIST Cybersecurity Framework (CSF), which function focuses on limiting the impact of a cybersecurity incident?

Accepted Answer

Respond

Answer

The Respond function of NIST CSF focuses on containing the impact of a cybersecurity incident once it has been detected.

Question 3

A risk register typically contains all of the following EXCEPT:

Accepted Answer

Employee performance evaluations

Answer

Risk registers document risk details, ownership, likelihood, impact, and treatment plans — HR performance data is not a risk register component.

Question 4

What does 'risk velocity' refer to in enterprise risk management?

Accepted Answer

The speed at which a risk could impact the organization if it materializes

Answer

Risk velocity measures how quickly a risk could escalate from identification to impact, influencing how rapidly a response must be activated.

Question 5

Which framework component ensures that risk information flows up, down, and across the organization?

Accepted Answer

Information and Communication

Answer

The Information and Communication component ensures relevant risk data is captured and distributed to stakeholders at all organizational levels.

(GRC) Governance, Risk, and Compliance Certification Practice Test