Isaca Certification Changed CRISC Questions

The greatest challenge for a risk practitioner during a merger of two organizations is the variances between organizational risk appetites, as they may indicate a significant difference in the risk culture, strategy, and objectives of the two organizations, and may require a complex and lengthy process of alignment and integration. Different taxonomies to categorize risk scenarios, disparate platforms for governance, risk, and compliance (GRC) systems, and dissimilar organizational risk acceptance protocols are not the greatest challenges, as they are more related to the technical, operational, or procedural aspects of risk management, rather than the strategic or cultural aspects of risk management. References = CRISC Review Manual, 7th Edition, page 109.

KRI thresholds are the levels or points that trigger an action or a response when a KRI reaches or exceeds them. They reflect the risk appetite of the organization, which is the amount and type of risk that it is willing to accept in pursuit of its objectives. A new privacy regulation may reduce the risk appetite of the organization, as it may impose stricter requirements and penalties for non-compliance. Therefore, the organization may need to adjust its KRI thresholds to lower levels, to ensure that it can identify and manage privacy risks more effectively and proactively

Conducting interviews with senior management is the best method for determining an enterprise’s current appetite for risk, because it helps to obtain the direct and qualitative input and feedback from the senior management on their expectations and preferences regarding the level and type of risk that the enterprise is willing to accept or pursue, in relation to its objectives and strategy. Risk appetite is the amount and nature of risk that an enterprise is willing to take in order to achieve its objectives and create value. Risk appetite is influenced by factors such as the enterprise’s culture, values, vision, mission, and strategy, as well as the external environment and stakeholders. Risk appetite may vary depending on the context and situation, and may change over time. Conducting interviews with senior management is the best method, as it helps to understand and capture the current and explicit risk appetite of the enterprise, and to align the risk management process and activities with the senior management’s risk vision and direction. Conducting comparative analysis of peer companies, reviewing brokerage firm assessments, and performing trend analysis using prior annual reports are all possible methods for determining an enterprise’s current appetite for risk, but they are not the best method, as they may provide only indirect, quantitative, or historical information, and may not reflect the current and specific risk appetite of the enterprise. References = Risk and Information Systems Control Study Manual, Chapter 2, Section 2.2.1, page 45

Ensuring segregation of duties are implemented within key systems or processes is the best strategy employed by risk management to prevent internal fraud, because it reduces the opportunity for a single person to manipulate or misuse the system or process for fraudulent purposes. Segregation of duties is a control that assigns different roles and responsibilities to different individuals, such that no one person can perform all the steps of a transaction or process. Requiring control owners to conduct an annual control certification, conducting regular internal and external audits on the systems supporting financial reporting, and requiring the information security officer to review unresolved incidents are all useful strategies to detect or deter internal fraud, but they are not the best strategy to prevent it, as they do not directly address the root cause of fraud. References = Risk and Information Systems Control Study Manual, Chapter 5, Section 5.3.1, page 197