Exactprep CRISC Questions

Key risk indicators (KRIs) are most useful during the monitoring phase of the risk management process, as they provide timely and relevant information on the current and future risk status and performance. KRIs are metrics that measure the level of risk exposure and the effectiveness of risk response strategies, and they have predefined thresholds that indicate the acceptable or unacceptable risk status. By monitoring the KRIs, the risk practitioner can identify and report any changes or deviations in the risk level, and take appropriate actions to manage the risk. KRIs are not most useful during the analysis, identification, or response selection phases, as they do not help to assess the likelihood or impact of the risk, to find the sources or causes of the risk, or to evaluate or choose the optimal risk response option. References = CRISC: Certified in Risk & Information Systems Control Sample Questions, question 222.

The greatest challenge for a risk practitioner during a merger of two organizations is the variances between organizational risk appetites, as they may indicate a significant difference in the risk culture, strategy, and objectives of the two organizations, and may require a complex and lengthy process of alignment and integration. Different taxonomies to categorize risk scenarios, disparate platforms for governance, risk, and compliance (GRC) systems, and dissimilar organizational risk acceptance protocols are not the greatest challenges, as they are more related to the technical, operational, or procedural aspects of risk management, rather than the strategicor cultural aspects of risk management. References = CRISC Review Manual, 7th Edition, page 109.

 A cost-benefit analysis is a technique that compares the costs and benefits of different risk response strategies, such as mitigating, transferring, avoiding, or accepting risks. A cost-benefit analysis can help justify investment in risk response strategies by showing the expected return on investment, the net present value, the break-even point, and the cost-effectiveness of each option.A cost-benefit analysis can also help prioritize the most optimal risk response strategies based on the available resources, the risk appetite, and the stakeholder expectations. References = Risk and Information Systems Control Study Manual, Chapter 3: Risk Response and Mitigation, Section 3.4: Risk Response Selection, p. 156-157.