Compliance and Auditing Risk Management 2

Question 1

In IT risk management, what does a Business Impact Analysis (BIA) determine?

Accepted Answer

The criticality of business processes and acceptable downtime in the event of disruption

Answer

A Business Impact Analysis identifies critical business functions, quantifies the impact of disruptions, and determines acceptable recovery time and recovery point objectives.

Question 2

What is the formula for calculating risk in qualitative risk assessment?

Accepted Answer

Risk = Likelihood × Impact

Answer

In qualitative risk assessment, risk is typically calculated as the product of the likelihood (probability) of a risk event occurring and the impact (severity) if it does occur.

Question 3

Which three-lines-of-defense model assigns risk management responsibilities to different organizational levels?

Accepted Answer

Three Lines of Defense / Three Lines Model

Answer

The Three Lines of Defense (updated to Three Lines Model by IIA in 2020) assigns risk management to: operational management, risk/compliance functions, and internal audit.

Question 4

A vendor risk management program primarily assesses risk from which type of entities?

Accepted Answer

Third-party suppliers and service providers

Answer

Vendor risk management evaluates and monitors risks posed by third-party suppliers, vendors, and service providers who have access to organizational data, systems, or processes.

Question 5

What does RPO (Recovery Point Objective) define in business continuity planning?

Accepted Answer

The maximum acceptable amount of data loss measured in time

Answer

Recovery Point Objective (RPO) defines the maximum acceptable period of data loss measured in time, determining how frequently data backups must occur.

Compliance and Auditing Practice Test

Compliance and Auditing Practice Test

Compliance and Auditing Risk Management 2