GRC Risk Management & Mitigation Strategies 3

Question 1

Which framework is most commonly associated with enterprise risk management (ERM) and uses components such as risk appetite and risk culture?

Accepted Answer

COSO ERM

Answer

The COSO ERM framework provides guidance on enterprise-wide risk management, including risk culture, governance, and appetite.

Question 2

A risk that is deliberately accepted because its cost to mitigate exceeds the potential loss is called:

Accepted Answer

Accepted risk

Answer

Risk acceptance (also called risk tolerance) means the organization knowingly chooses to live with the risk rather than spend resources reducing it.

Question 3

In a risk heat map, which axis typically represents the likelihood of a risk occurring?

Accepted Answer

Horizontal axis (X-axis)

Answer

Convention varies, but likelihood (probability) is most commonly plotted on the X-axis and impact on the Y-axis in risk heat maps.

Question 4

Which risk treatment option introduces new risks as a direct result of applying the original treatment?

Accepted Answer

Secondary risk

Answer

Secondary risks are unintended new risks created by implementing a risk response plan.

Question 5

What does a qualitative risk assessment rely on primarily?

Accepted Answer

Expert judgment and descriptive scales (e.g., High/Medium/Low)

Answer

Qualitative risk assessments use subjective scoring and descriptive categories rather than precise numerical data.

(GRC) Governance, Risk, and Compliance Certification Practice Test