I85PREP
⌘ K
CISEC-IT study materials
CISEC-IT study resources

CISEC-IT practice questions

One question at a time. Build your CISEC-IT understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security Governance, Strategy, and Executive Leadership

An organization's board asks the CISO to describe how security spending aligns with business objectives over the next three years. Which artifact is the primary vehicle for this alignment?

  1. The incident response runbook
  2. The annual penetration test report
  3. The security strategic plan derived from enterprise strategy Correct answer.
  4. The firewall rule audit log

Explanation

A security strategy translates enterprise goals into multi-year security objectives, initiatives, and investment priorities, which is exactly what a board needs to see. Operational artifacts such as test reports, runbooks, and rule audits support execution but do not express strategic alignment.

Question 2Security Governance, Strategy, and Executive Leadership

A CISO wants a single governance body that approves security policy, arbitrates risk acceptance above defined thresholds, and reports to the board. Which structure best fits?

  1. A security steering committee with cross-functional executive membership Correct answer.
  2. A weekly SOC shift handover meeting
  3. An internal audit fieldwork team
  4. A vendor selection working group

Explanation

A steering committee with cross-functional executive representation provides the authority to approve policy and decide escalated risk acceptance while maintaining a board reporting line. The other options are operational or narrowly scoped and lack enterprise decision authority.

Question 3Security Governance, Strategy, and Executive Leadership

A regulator requires the organization to demonstrate that security roles and responsibilities are formally assigned and understood. Which governance instrument most directly satisfies this?

  1. A business continuity exercise calendar
  2. A list of open vulnerability tickets
  3. A cloud provider's shared responsibility diagram
  4. An approved information security policy with defined roles and a supporting RACI matrix Correct answer.

Explanation

An approved policy that names accountable roles, reinforced by a RACI matrix, is the standard evidence that responsibilities are formally defined and communicated. The other items are operational records or external documents that do not assign internal accountability.

Question 4Security Governance, Strategy, and Executive Leadership

Executive leadership asks the CISO to express residual risk in terms the board already uses for other business risks. Which approach is most appropriate?

  1. Provide the full technical findings of the last red team exercise
  2. Map security risk scenarios to financial, regulatory, and reputational impact ranges Correct answer.
  3. Present the number of blocked attacks per week
  4. Report only the raw count of open vulnerabilities

Explanation

Boards make decisions using business impact categories, so translating security scenarios into financial, regulatory, and reputational terms enables meaningful risk dialogue. Raw technical counts and attack volumes are activity metrics that do not convey consequence.

Question 5Security Governance, Strategy, and Executive Leadership

An organization decides to accept a high-severity risk rather than remediate it. Who should formally own and sign that acceptance?

  1. The security analyst who discovered the issue
  2. The vendor supplying the affected technology
  3. The business owner accountable for the affected asset or process Correct answer.
  4. The penetration tester who reported the finding

Explanation

Risk acceptance authority belongs to the accountable business owner who bears the consequence, with security providing advice and recording the decision. Technical staff, vendors, and testers can identify or explain risk but cannot accept it on the business's behalf.

Question 6Security Governance, Strategy, and Executive Leadership

A CISO must justify a multi-year security investment to the CFO. Which combination best supports the business case?

  1. The number of security tools currently deployed
  2. The size of the security team compared to peers
  3. The count of security awareness emails sent
  4. Risk reduction estimates, compliance obligations, and cost of potential loss events Correct answer.

Explanation

A credible business case links the investment to quantified risk reduction, mandatory obligations, and avoided loss, which are the factors finance leaders weigh. Tool counts, headcount comparisons, and awareness activity are inputs rather than outcome-based justification.

Question 7Security Governance, Strategy, and Executive Leadership

Which metric best indicates whether a security program is maturing in line with its strategic roadmap?

  1. Number of employees who completed onboarding
  2. Total pages of security policy documentation
  3. Percentage of roadmap initiatives delivered against planned milestones Correct answer.
  4. Total number of alerts generated by monitoring tools

Explanation

Roadmap delivery against milestones shows whether the program is executing the strategy it committed to, making it a governance-level maturity indicator. Alert volumes, onboarding counts, and policy page counts are activity or volume measures with no direct link to strategic progress.

Question 8Security Governance, Strategy, and Executive Leadership

A new privacy regulation takes effect in a market where the company operates. What is the CISO's most appropriate first governance action?

  1. Delegate the entire matter to the IT service desk
  2. Immediately purchase a new data loss prevention product
  3. Suspend all processing in that market until legal confirms
  4. Perform a compliance gap assessment and report obligations and exposure to executive leadership Correct answer.

Explanation

Governance begins with understanding the obligation and its gaps, then informing executives so risk-based decisions can be made. Buying tools before scoping, halting operations prematurely, or pushing a legal matter to the service desk are disproportionate or misdirected responses.

Question 9Security Governance, Strategy, and Executive Leadership

Which document typically authorizes the security program and establishes the CISO's mandate and reporting line?

  1. A board-approved security charter Correct answer.
  2. A network topology diagram
  3. A software bill of materials
  4. An asset inventory spreadsheet

Explanation

A charter formally establishes the security function, its authority, scope, and reporting relationship, giving the CISO an accountable mandate. Topology diagrams, SBOMs, and asset inventories are technical references that confer no authority.

Question 10Security Governance, Strategy, and Executive Leadership

A CISO is building a risk appetite statement. Which content makes it actionable for decision-makers?

  1. Defined tolerance thresholds for risk categories with escalation criteria Correct answer.
  2. A general commitment to being secure
  3. A schedule of upcoming audits
  4. A list of every security tool in use

Explanation

Risk appetite becomes actionable when it specifies tolerance thresholds by risk category and states when issues must be escalated. Vague commitments, tool lists, and audit schedules provide no decision boundaries for accepting or rejecting risk.

Question 11Security Governance, Strategy, and Executive Leadership

Executive leadership wants assurance that third-party suppliers meet security expectations. Which governance mechanism is most effective?

  1. Contractual security requirements with periodic assessment and defined remediation terms Correct answer.
  2. Assuming large suppliers are inherently secure
  3. Relying on the supplier's marketing materials
  4. Reviewing the supplier's public website for a privacy notice

Explanation

Enforceable contract terms combined with recurring assessment and remediation obligations create accountability that can be verified and acted upon. Marketing claims, size assumptions, and website notices provide no assurance or recourse.

Question 12Security Governance, Strategy, and Executive Leadership

During a crisis, executives need a clear picture of who decides whether to shut down a production line after a cyber incident. Which element of governance resolves this?

  1. The retention period for security logs
  2. The number of analysts on shift
  3. The mean time to detect security events
  4. A documented incident escalation and decision-authority matrix Correct answer.

Explanation

Decision authority during incidents must be defined in advance so that business and security leaders know who can authorize disruptive actions. Detection metrics, staffing levels, and log retention support response but do not resolve who holds decision rights.

Question 13Security Governance, Strategy, and Executive Leadership

Which practice best embeds security governance into business unit decision-making rather than centralizing all decisions in the security team?

  1. Outsourcing all security decisions to a managed service provider
  2. Removing security review from project intake
  3. Requiring every security question to be escalated to the CISO
  4. Assigning security champions within business units who follow shared governance standards Correct answer.

Explanation

Embedded champions extend governance standards into business units so decisions are made locally within agreed guardrails. Centralizing every question, removing review, or fully outsourcing decisions either creates bottlenecks or surrenders accountability.

Question 14Security Governance, Strategy, and Executive Leadership

A CISO reports to the CIO, who also owns technology delivery. What governance concern does this reporting line raise?

  1. Faster approval of security tool purchases
  2. Increased accuracy of technology cost forecasts
  3. Reduced independence in challenging technology decisions that introduce risk Correct answer.
  4. Improved alignment of security with infrastructure teams

Explanation

When security reports into the same leader responsible for delivery speed, pressure to avoid delaying projects can weaken independent challenge of risk decisions. The other options describe possible operational benefits, not the governance concern of impaired independence.

Question 15Security Governance, Strategy, and Executive Leadership

Which approach best ensures security policies remain current as the business and threat landscape change?

  1. Publishing policies once and archiving them permanently
  2. Delegating all policy content to the legal department
  3. Reviewing policies only after an audit finding
  4. Scheduled periodic review with defined ownership and a change-triggered review process Correct answer.

Explanation

Combining a regular review cycle with event-driven review keeps policies aligned to business and threat changes while assigning clear ownership. One-time publication, audit-driven-only review, and full delegation to legal leave security content unmanaged.

Question 16Security Governance, Strategy, and Executive Leadership

An executive wants to know whether the security program is effective, not just busy. Which evidence set best answers this?

  1. Total hours logged by the security team
  2. Trends in control effectiveness testing, incident outcomes, and risk treatment closure rates Correct answer.
  3. Number of security meetings held per quarter
  4. Count of policies published this year

Explanation

Effectiveness is demonstrated by whether controls work, incidents are contained, and identified risks are actually treated. Effort measures such as hours, meetings, and policy counts show activity but say nothing about outcomes.

Question 17Security Governance, Strategy, and Executive Leadership

Which element is essential when the CISO presents a risk-based decision to the board for approval?

  1. A list of every open port on the network
  2. The options considered, their business impact, and a clear recommendation Correct answer.
  3. The vendor names of all security products deployed
  4. The full packet capture from a recent intrusion attempt

Explanation

Boards approve decisions when they see alternatives, consequences, and a recommendation they can act on. Raw packet captures, port lists, and product names are technical detail that does not support an executive decision.

Question 18Security Governance, Strategy, and Executive Leadership

A business unit wants to adopt a new SaaS platform that will store regulated data. Which governance gate should apply before approval?

  1. Confirmation that the platform has a mobile app
  2. A review of the vendor's logo and branding guidelines
  3. A risk assessment covering data classification, supplier assurance, and control fit Correct answer.
  4. A check that the vendor has a large social media following

Explanation

Approval should rest on whether the platform can protect the data class involved, whether the supplier provides adequate assurance, and whether controls meet requirements. Branding, mobile availability, and social media presence are irrelevant to security governance.

Question 19Security Governance, Strategy, and Executive Leadership

What distinguishes a security governance function from a security operations function?

  1. Governance sets direction, authority, and oversight, while operations executes day-to-day controls Correct answer.
  2. Governance handles only technical alerts, while operations writes policy
  3. Governance is performed only by external auditors
  4. Operations owns risk acceptance decisions

Explanation

Governance defines decision rights, policy, and oversight, whereas operations carries out monitoring, response, and control execution. Reversing these roles or assigning risk acceptance to operations misrepresents how accountability is structured.

Question 20Security Governance, Strategy, and Executive Leadership

An organization suffers repeated incidents from the same root cause despite remediation tickets being closed. Which governance failure is most likely?

  1. The organization has too many security policies
  2. Monitoring tools generate too few alerts
  3. The incident response team has too many analysts
  4. Remediation closure is tracked without verifying that the underlying control weakness is fixed Correct answer.

Explanation

Recurring incidents after ticket closure indicate that governance measures completion of tasks rather than verification of root-cause correction. Staffing levels, policy volume, and alert counts do not explain why the same weakness persists.

Question 21Security Governance, Strategy, and Executive Leadership

Which statement best describes the CISO's accountability for risk in a federated governance model?

  1. The CISO personally accepts all risk on behalf of the enterprise
  2. Business owners are exempt from security standards
  3. The CISO delegates all accountability to external auditors
  4. The CISO sets standards and oversees, while business owners accept risk within approved tolerances Correct answer.

Explanation

In a federated model the CISO provides standards and oversight while accountable business owners accept risk inside thresholds set by leadership. The CISO cannot personally absorb enterprise risk, business units remain bound by standards, and auditors provide assurance rather than accountability.

Question 22Security Governance, Strategy, and Executive Leadership

Which is the most appropriate role for internal audit in the security governance structure?

  1. Providing independent assurance on the design and effectiveness of security controls Correct answer.
  2. Accepting residual risk for critical systems
  3. Operating the security monitoring platform
  4. Approving security policy on behalf of management

Explanation

Internal audit's value lies in independent, objective assurance about controls, which requires separation from management functions. Approving policy, running monitoring, or accepting risk would compromise that independence.

Question 23Security Governance, Strategy, and Executive Leadership

A CISO wants to measure whether security awareness efforts change behavior rather than just inform staff. Which indicator is best?

  1. Number of awareness posters displayed in offices
  2. Percentage of staff who opened the awareness email
  3. Decline in phishing simulation click and credential-entry rates over time Correct answer.
  4. Count of training modules available in the catalog

Explanation

Behavioral indicators such as falling click and credential-entry rates in simulations show whether staff actually act more safely. Poster counts, email opens, and catalog size measure exposure to content, not behavior change.

Question 24Security Governance, Strategy, and Executive Leadership

Which factor most strongly determines whether a security strategy will be sustained across leadership changes?

  1. The number of security tools deployed
  2. The personal charisma of the current CISO
  3. The frequency of penetration tests
  4. Integration of security objectives into enterprise planning and performance management Correct answer.

Explanation

Embedding security objectives in enterprise planning and performance management institutionalizes the strategy beyond any individual leader. Charisma, tool counts, and testing frequency depend on people or activity and do not create durable organizational commitment.

Question 25Security Governance, Strategy, and Executive Leadership

Which artifact best demonstrates to regulators that security decisions are made consistently and with accountability?

  1. The organization chart of the IT department
  2. A screenshot of the security dashboard
  3. A list of security conferences attended by staff
  4. Documented decision records showing rationale, approver, and date Correct answer.

Explanation

Decision records capture who approved what and why, providing auditable evidence of consistent, accountable governance. Dashboards, org charts, and conference lists do not document individual decisions or their rationale.

Question 26Security Governance, Strategy, and Executive Leadership

An organization is deciding how much cyber risk it is willing to accept in its customer-facing payment platform. Which governance artifact most directly records that decision and the authority behind it?

  1. A formal risk appetite and tolerance statement approved by the board or its risk committee Correct answer.
  2. An incident response runbook covering payment system outages
  3. A vulnerability scan report produced by the security operations team
  4. A vendor security questionnaire completed by the payment processor

Explanation

Risk appetite and tolerance statements are governance instruments: they record the amount and type of risk leadership chooses to accept and identify who approved that position. Operational artifacts such as scan reports, runbooks, and vendor questionnaires inform decisions but do not themselves express an authorized risk position.

Question 27Security Governance, Strategy, and Executive Leadership

A CISO wants the security strategy to remain funded and enforced after the current CEO departs. Which action most strengthens that durability?

  1. Embedding security requirements into enterprise risk management and corporate policy approved by the board Correct answer.
  2. Publishing an annual security awareness campaign calendar
  3. Hiring additional analysts to reduce the mean time to detect incidents
  4. Increasing the frequency of penetration tests on internet-facing systems

Explanation

Strategy endures when it is anchored in institutional mechanisms such as enterprise risk management and board-approved policy, because those persist beyond any individual executive. Awareness campaigns, testing cadence, and staffing changes improve execution but are not governance anchors that survive leadership turnover.

Question 28Security Governance, Strategy, and Executive Leadership

A business unit plans to deploy an AI assistant that will process employee HR records. Under a federated security governance model, which step best reflects the CISO's role before deployment proceeds?

  1. Provide the risk criteria and control requirements the business unit must satisfy, and retain independent risk acceptance authority Correct answer.
  2. Take operational ownership of the AI system once it enters production
  3. Delegate all risk decisions to the business unit so accountability stays local
  4. Approve the vendor contract on behalf of the business unit to speed procurement

Explanation

In federated governance, business units own their systems while the CISO sets risk criteria, defines required controls, and holds authority to accept or escalate residual risk. This keeps decision-making close to the business without diluting the security function's accountability for enterprise risk.

Question 29Security Governance, Strategy, and Executive Leadership

Internal audit is reviewing the security program. Which assignment of responsibilities preserves audit independence while supporting governance?

  1. Internal audit reports to the CISO so findings can be remediated quickly
  2. Internal audit owns the risk register and updates it after each security assessment
  3. Internal audit assesses control design and operating effectiveness and reports to the audit committee Correct answer.
  4. Internal audit designs and operates the security controls, then reports on their effectiveness

Explanation

Audit independence requires that internal audit neither designs nor operates the controls it examines, and that it reports to a governing body such as the audit committee. Assessing design and operating effectiveness while remaining outside management gives the board objective assurance.

Question 30Security Governance, Strategy, and Executive Leadership

A regulator asks an organization to demonstrate that security exceptions are granted deliberately, time-bound, and visible to senior leadership. Which combination of governance controls best satisfies that expectation?

  1. A documented exception process with defined approval authority, expiry dates, compensating controls, and periodic reporting to a risk committee Correct answer.
  2. An annual policy review in which exceptions are consolidated into the general security policy
  3. A monthly vulnerability report showing that open findings are tracked by the security team
  4. A ticketing workflow that logs exception requests and closes them automatically after a fixed period

Explanation

Regulators look for evidence that exceptions are consciously approved at the right level, limited in duration, mitigated by compensating controls, and reported upward so leadership retains visibility. This combination shows consistent, accountable decision-making rather than mere record-keeping.

Question 31Risk Management and Enterprise Risk Frameworks

In enterprise risk management, what does the term 'risk appetite' describe?

  1. The maximum financial loss an insurer will cover under a single policy
  2. The amount and type of risk an organization is willing to accept in pursuit of its objectives Correct answer.
  3. The set of controls that eliminate all residual risk from a process
  4. The annual budget allocated to the internal audit function

Explanation

Risk appetite is the level and type of risk an organization is prepared to accept before action is deemed necessary to reduce it. It is set by senior leadership and expressed relative to strategic objectives, not tied to insurance limits or audit budgets.

Question 32Risk Management and Enterprise Risk Frameworks

Which statement best distinguishes risk tolerance from risk appetite?

  1. Risk tolerance and appetite are synonyms and are used interchangeably in all frameworks
  2. Risk tolerance is set by regulators, while appetite is set by shareholders
  3. Risk tolerance applies only to financial risks, while appetite applies only to operational risks
  4. Risk tolerance is the acceptable variation around objectives for a specific risk, while appetite is the aggregate level of risk the organization accepts Correct answer.

Explanation

Appetite is the broad, aggregate statement of acceptable risk, while tolerance (or risk threshold) operationalizes it at the level of individual risks or objectives. Tolerance defines how much deviation from a target is acceptable before escalation.

Question 33Risk Management and Enterprise Risk Frameworks

In the COSO ERM framework, which component addresses the process of identifying, assessing, and responding to risk?

  1. Review and Revision
  2. Strategy and Objective-Setting
  3. Governance and Culture
  4. Performance Correct answer.

Explanation

The Performance component covers identifying and assessing risk, prioritizing risk, and implementing risk responses. Governance and Culture and Strategy and Objective-Setting are separate components in the 2017 COSO ERM framework.

Question 34Risk Management and Enterprise Risk Frameworks

A risk register entry records a likelihood of 4 on a 5-point scale and an impact of 5 on a 5-point scale. Using a standard multiplicative scoring approach, what is the inherent risk score?

  1. 20 Correct answer.
  2. 4.5
  3. 9
  4. 1

Explanation

A multiplicative risk score is the product of likelihood and impact, so 4 x 5 equals 20. Additive or ratio approaches are not the standard matrix method used in most risk registers.

Question 35Risk Management and Enterprise Risk Frameworks

Which risk response involves shifting the financial consequence of a risk to a third party?

  1. Transfer Correct answer.
  2. Acceptance
  3. Avoidance
  4. Mitigation

Explanation

Transfer shifts the financial impact to another party, typically through insurance, contracts, or outsourcing. Avoidance eliminates the activity, mitigation reduces likelihood or impact, and acceptance retains the risk.

Question 36Risk Management and Enterprise Risk Frameworks

What is the primary purpose of a key risk indicator (KRI)?

  1. To document regulatory penalties incurred in prior years
  2. To calculate the organization's cost of capital
  3. To provide early warning of increasing risk exposure relative to a defined threshold Correct answer.
  4. To record the outcome of internal audit findings

Explanation

KRIs are metrics designed to signal changes in risk exposure before losses occur, allowing proactive management. They are forward-looking and tied to thresholds that trigger escalation.

Question 37Risk Management and Enterprise Risk Frameworks

Which of the following best describes residual risk?

  1. The risk that arises from a change in regulations
  2. The risk that exists before any controls are considered
  3. The risk that remains after controls and responses have been applied Correct answer.
  4. The risk that a control will fail to operate as designed

Explanation

Residual risk is the exposure remaining after existing controls and risk responses are taken into account. It is compared against tolerance to determine whether further action is needed.

Question 38Risk Management and Enterprise Risk Frameworks

A heat map used in enterprise risk management typically plots which two dimensions?

  1. Frequency and ownership
  2. Likelihood and impact Correct answer.
  3. Control design and operating effectiveness
  4. Cost and duration

Explanation

A risk heat map plots likelihood against impact to visualize relative risk exposure and prioritize responses. The resulting grid helps leadership focus on high-likelihood, high-impact risks.

Question 39Risk Management and Enterprise Risk Frameworks

An organization sets a tolerance of 2% for customer churn and current churn reaches 3.5%. According to ERM practice, what should happen?

  1. The risk should be accepted because churn is an operational metric
  2. The tolerance should be revised upward to match the current churn rate
  3. The risk should be recorded as a control deficiency only
  4. The risk should be escalated for management action because it exceeds tolerance Correct answer.

Explanation

When a metric breaches the defined tolerance, the risk exceeds acceptable limits and should be escalated for a response decision. Revising the tolerance to match performance defeats the purpose of the threshold.

Question 40Risk Management and Enterprise Risk Frameworks

A risk manager assigns an owner to each risk in the register. What is the primary accountability of a risk owner?

  1. To independently audit the effectiveness of controls
  2. To fund risk mitigation from their personal budget
  3. To monitor the risk and ensure appropriate responses and reporting are in place Correct answer.
  4. To approve the enterprise risk appetite statement

Explanation

The risk owner is accountable for managing the assigned risk, including monitoring exposure, implementing responses, and reporting status. Independence of assurance is preserved by separating this from audit.

Question 41Risk Management and Enterprise Risk Frameworks

In a bow-tie risk analysis, what do the left and right sides of the diagram represent?

  1. Threats and consequences, with barriers on each side Correct answer.
  2. Inherent and residual risk levels
  3. Likelihood and impact scores
  4. Controls and audit findings

Explanation

The bow-tie model places the risk event at the center, threats and preventive barriers on the left, and consequences with mitigating barriers on the right. It clarifies the relationship between causes, controls, and outcomes.

Question 42Risk Management and Enterprise Risk Frameworks

Which scenario best illustrates a 'black swan' event in enterprise risk terms?

  1. A planned merger that is announced to shareholders in advance
  2. A recurring operational error that appears in monthly incident reports
  3. A rare, high-impact event that was considered highly improbable and is rationalized only after it occurs Correct answer.
  4. A regulatory change that was publicly consulted on for a year

Explanation

A black swan is an outlier event with severe impact that is unexpected and retrospectively explained. It differs from routine operational incidents or foreseeable changes.

Question 43Risk Management and Enterprise Risk Frameworks

A company uses a risk matrix with likelihood and impact but discovers that many low-probability, catastrophic risks score the same as moderate risks. What is a recognized limitation of this approach?

  1. Likelihood scales must have exactly ten levels
  2. Risk matrices cannot incorporate qualitative judgment
  3. Impact scales are always expressed in monetary terms
  4. Multiplicative scoring can obscure severe tail risks because low likelihood compresses the score Correct answer.

Explanation

Multiplying likelihood by impact can make catastrophic but rare risks appear equivalent to moderate risks, masking tail exposure. Practitioners often add separate treatment for catastrophic risks or use alternative techniques.

Question 44Risk Management and Enterprise Risk Frameworks

What role does the board of directors typically play in enterprise risk management?

  1. Performing day-to-day risk monitoring and control testing
  2. Providing oversight and approving the risk appetite and ERM framework Correct answer.
  3. Independently auditing the risk management function
  4. Designing the technical controls for IT systems

Explanation

The board provides oversight, approves the risk appetite, and ensures the ERM framework is in place. Operational monitoring and control design are delegated to management and staff.

Question 45Risk Management and Enterprise Risk Frameworks

An organization identifies a risk with high impact but very low likelihood that would threaten solvency. Which response is most appropriate under ERM principles?

  1. Accept the risk without further action because likelihood is low
  2. Reduce the impact by eliminating all related business activities
  3. Transfer or finance the tail risk and establish contingency plans Correct answer.
  4. Ignore the risk because it is below the likelihood threshold

Explanation

Catastrophic low-likelihood risks warrant transfer or financing mechanisms and contingency planning because acceptance alone may exceed tolerance. Dismissing them based on likelihood ignores the severity of impact.

Question 46Risk Management and Enterprise Risk Frameworks

Which statement accurately describes the three lines model in risk governance?

  1. Internal audit owns risk, management provides oversight, and the board provides assurance
  2. External auditors own risk, regulators provide oversight, and management provides assurance
  3. The board owns risk, internal audit provides oversight, and management provides assurance
  4. Management owns risk, a risk function provides oversight, and internal audit provides independent assurance Correct answer.

Explanation

The three lines model separates risk ownership by management, oversight by a risk or compliance function, and independent assurance by internal audit. This separation preserves objectivity in assurance.

Question 47Risk Management and Enterprise Risk Frameworks

A risk assessment uses a scale where impact is rated 1 to 5 and likelihood 1 to 5, and the organization defines any score of 15 or higher as unacceptable. A risk scores 12. What is the appropriate conclusion?

  1. The risk is unacceptable and must be escalated immediately
  2. The risk score must be recalculated using a different scale
  3. The risk is within tolerance but should be monitored Correct answer.
  4. The risk should be removed from the register

Explanation

A score of 12 falls below the defined threshold of 15, so the risk is within tolerance and subject to ongoing monitoring. Escalation is triggered only when the threshold is met or exceeded.

Question 48Risk Management and Enterprise Risk Frameworks

Which of the following is a leading indicator rather than a lagging indicator of operational risk?

  1. Total insurance claims paid in the previous year
  2. Value of losses recorded in the prior quarter
  3. Number of open remediation actions past their due date Correct answer.
  4. Volume of customer complaints received last year

Explanation

Overdue remediation actions signal unresolved control weaknesses that may lead to future losses, making them a leading indicator. Losses, complaints, and claims are historical outcomes and are therefore lagging indicators.

Question 49Risk Management and Enterprise Risk Frameworks

In the context of ERM, what is the purpose of stress testing?

  1. To calculate the expected value of routine operational losses
  2. To confirm that controls operated as designed during the audit period
  3. To verify that financial statements comply with accounting standards
  4. To evaluate how a portfolio or organization performs under severe but plausible adverse scenarios Correct answer.

Explanation

Stress testing examines performance under severe but plausible scenarios to reveal vulnerabilities that normal conditions may hide. It complements, but does not replace, control testing and financial reporting assurance.

Question 50Risk Management and Enterprise Risk Frameworks

An organization decides to enter a new market despite high regulatory uncertainty. Which ERM concept best describes this decision?

  1. Risk elimination through control redesign
  2. Risk transfer through insurance
  3. Risk avoidance through market exit
  4. Risk-taking within the approved appetite to pursue strategic objectives Correct answer.

Explanation

Taking on calculated risk to pursue strategic objectives is consistent with the approved risk appetite. ERM does not seek to eliminate all risk but to ensure risk-taking is intentional and within tolerance.