CRISC Risk Monitoring, Reporting, and KRIs

Question 1

A Key Risk Indicator (KRI) is BEST defined as:

Accepted Answer

A metric that signals increasing risk exposure before an incident occurs

Answer

KRIs are forward-looking metrics that provide early warning signals of increasing risk, enabling proactive management before losses occur.

Question 2

Which characteristic distinguishes a HIGH-QUALITY KRI from a poorly designed one?

Accepted Answer

It is measurable, timely, and directly correlated to a specific risk

Answer

Effective KRIs must be quantifiable, available in time to act, and have a proven correlation to the risk they are monitoring.

Question 3

The PRIMARY purpose of risk monitoring in the CRISC framework is to:

Accepted Answer

Detect changes in the risk environment that require updated risk responses

Answer

Risk monitoring detects environmental changes — new threats, control failures, or shifting business conditions — that may require updates to risk responses.

Question 4

Which risk reporting element is MOST valuable to a board-level audience?

Accepted Answer

A summary of top risks and their alignment with risk appetite

Answer

Board members need a concise, strategic view of top risks relative to risk appetite — not granular technical details that belong in operational reporting.

Question 5

A threshold breach in a KRI should MOST immediately trigger:

Accepted Answer

Escalation to the risk owner and review of the associated control

Answer

When a KRI threshold is breached, the risk owner must be notified immediately to review whether the associated controls need reinforcement or response.

CRISC - Certified in Risk and Information Systems Control Practice Test

CRISC - Certified in Risk and Information Systems Control Practice Test

CRISC Risk Monitoring, Reporting, and KRIs