I85PREP
⌘ K
CISR Risk Management study materials
CISR Risk Management study resources

CISR Risk Management practice questions

One question at a time. Build your CISR Risk Management understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Introduction to Risk Management

In CISR risk management, which statement best defines risk?

  1. The certainty that an event will produce a loss
  2. Any event that has already caused measurable financial damage
  3. The combination of the likelihood of an event and its consequences Correct answer.
  4. The process of transferring liability to a third party

Explanation

Risk is conventionally expressed as the effect of uncertainty on objectives, combining how likely an event is with the impact it would produce. This pairing of likelihood and consequence is the foundation for later scoring and treatment decisions. Events that have already occurred are incidents or losses, not risk itself.

Question 2Introduction to Risk Management

Which pairing correctly matches a risk management term with its meaning?

  1. Risk register - the document that lists only external threats
  2. Residual risk - the risk that exists before any controls are applied
  3. Risk appetite - the amount of risk an organization is willing to accept Correct answer.
  4. Inherent risk - the risk remaining after controls are applied

Explanation

Risk appetite expresses how much risk the organization is prepared to pursue or retain in order to meet its objectives. Inherent risk is measured before controls and residual risk after controls, so those two definitions are reversed in the other options. A risk register records identified risks from all sources, not only external threats.

Question 3Introduction to Risk Management

A risk practitioner is building a register entry for a supplier failure. Which element is essential to make the entry usable for later risk treatment?

  1. The full contract text with the supplier
  2. An assessment of likelihood and impact plus an assigned owner Correct answer.
  3. A guarantee that the risk will never materialize
  4. The name of the person who first mentioned the risk

Explanation

A usable register entry needs a structured assessment of likelihood and impact together with a named owner who is accountable for treatment. Without an assessment the entry cannot be prioritized, and without an owner it will not be actioned. The other items may be useful context but do not make the entry actionable.

Question 4Introduction to Risk Management

In the CISR risk management process, what is the primary purpose of risk identification?

  1. To calculate the exact financial loss of each risk
  2. To confirm that no risks remain in the organization
  3. To determine which risks exist and should be recorded for further analysis Correct answer.
  4. To decide immediately which risks will be insured

Explanation

Risk identification is about discovering, recognizing, and describing risks so they can be recorded and passed to analysis. Quantifying losses and choosing treatments belong to later stages of the process. Identification is iterative and never confirms that all risks have been found.

Question 5Introduction to Risk Management

Which statement correctly distinguishes risk analysis from risk evaluation?

  1. Analysis decides whether a risk is acceptable; evaluation calculates likelihood
  2. Analysis and evaluation are synonyms in the CISR framework
  3. Analysis applies controls; evaluation removes the risk entirely
  4. Analysis develops an understanding of the risk; evaluation compares it against criteria Correct answer.

Explanation

Risk analysis builds understanding of the nature and level of a risk, including its likelihood and impact. Risk evaluation then uses that understanding to compare the risk against agreed criteria and decide whether further action is needed. The two are sequential and distinct, not interchangeable.

Question 6Introduction to Risk Management

Which of the following is a valid risk treatment option under CISR guidance?

  1. Avoiding the activity that creates the risk Correct answer.
  2. Ignoring the risk until it occurs
  3. Recording the risk without assigning an owner
  4. Reporting the risk to a regulator as a substitute for action

Explanation

Risk treatment options include avoiding the activity, reducing likelihood or impact, transferring the risk, and accepting it with awareness. Avoidance removes the exposure by not undertaking the activity. Ignoring a known risk is not a treatment and leaves the organization exposed without a decision record.

Question 7Introduction to Risk Management

What does a risk matrix with likelihood on one axis and impact on the other allow a practitioner to do?

  1. Eliminate the need for a risk register
  2. Replace the need for any documented risk criteria
  3. Guarantee that high-scoring risks will not occur
  4. Rank risks into priority bands for attention and action Correct answer.

Explanation

A likelihood-by-impact matrix converts assessments into scores that can be grouped into bands such as low, medium, and high. Those bands help prioritize which risks receive attention and resources first. The matrix is a prioritization aid, not a guarantee or a substitute for the register and criteria.

Question 8Introduction to Risk Management

An organization states that it will accept only risks whose assessed level falls within defined tolerance limits. Which concept does this describe?

  1. Risk tolerance expressed as acceptable deviation from appetite Correct answer.
  2. Risk capacity expressed as a legal constraint
  3. Risk avoidance expressed as a project cancellation
  4. Risk transfer expressed as an insurance limit

Explanation

Risk tolerance describes the acceptable level of variation around the organization's risk appetite, often expressed as limits that must not be exceeded. Capacity refers to the maximum risk the organization could bear, which is a different and usually larger concept. Transfer and avoidance are treatment responses rather than statements of acceptable limits.

Question 9Introduction to Risk Management

A team identifies a cyber risk, estimates its likelihood and impact, compares the result to its tolerance, and decides to buy insurance. Which sequence of process steps does this describe?

  1. Analysis, treatment, evaluation, identification
  2. Evaluation, identification, treatment, analysis
  3. Identification, analysis, evaluation, treatment Correct answer.
  4. Treatment, analysis, identification, evaluation

Explanation

The team first recognizes the risk, then analyzes likelihood and impact, then evaluates the result against tolerance, and finally selects a treatment. This follows the standard process order from identification through treatment. The other sequences place treatment or evaluation before the information needed to support them.

Question 10Introduction to Risk Management

A risk owner records that a risk is 'accepted' but sets no review date and no monitoring trigger. Why is this a weakness in the risk management process?

  1. Accepted risks must be removed from the register
  2. Acceptance requires regulator approval in every case
  3. Acceptance is never a permitted treatment under CISR guidance
  4. Accepted risks still change and must be monitored against triggers and review dates Correct answer.

Explanation

Acceptance is a legitimate treatment, but it is only valid while the risk stays within tolerance. Monitoring, review dates, and triggers ensure the decision is revisited if likelihood or impact changes. Leaving an accepted risk unmonitored turns a deliberate decision into an unmanaged exposure.

Question 11Introduction to Risk Management

A practitioner must choose between a qualitative and a quantitative approach for assessing a new operational risk. Which consideration most directly favors a qualitative approach?

  1. Reliable historical loss data are unavailable and speed of assessment matters Correct answer.
  2. The regulator mandates a statistical loss distribution model
  3. The risk has a long record of precisely measured incidents
  4. The organization needs a defensible monetary estimate for capital planning

Explanation

Qualitative assessment relies on structured judgment and scales, which suits situations where data are scarce and a timely view is needed. Quantitative methods demand reliable data and are preferred when monetary precision is required. Where a regulator mandates a statistical model or rich loss data exist, quantitative approaches are the better fit.

Question 12Introduction to Risk Management

Which statement best describes the role of the 'three lines model' in risk management?

  1. It requires all risk decisions to be made by the internal audit function
  2. It separates operational ownership, risk oversight, and independent assurance Correct answer.
  3. It removes the need for a board-level risk committee
  4. It assigns every risk to an external consultant

Explanation

The three lines model distinguishes management who own and manage risk, a risk and compliance function that provides oversight and challenge, and internal audit which gives independent assurance. This separation supports clear accountability and reduces conflicts of interest. It does not move decision-making to audit or eliminate governance bodies.

Question 13Introduction to Risk Management

A risk assessment scores likelihood as 4 on a 5-point scale and impact as 5 on a 5-point scale. Using a simple multiplicative matrix, what is the score and how should it typically be treated?

  1. Score 9, which falls in the lowest priority band
  2. Score 4.5, which is always treated as medium
  3. Score 1, because the scales differ
  4. Score 20, which falls in a high priority band requiring prompt action Correct answer.

Explanation

A multiplicative matrix multiplies likelihood by impact, giving 4 × 5 = 20. On a 5-point scale the maximum is 25, so a score of 20 sits near the top and normally falls in a high or critical band. High-band risks are escalated and actioned promptly rather than deferred.

Question 14Introduction to Risk Management

Which item is the clearest example of a risk 'cause' rather than a risk 'event' or 'impact'?

  1. Loss of customer trust and revenue
  2. Weak patch management on internet-facing systems Correct answer.
  3. A ransomware attack encrypting servers
  4. A regulatory fine of a stated amount

Explanation

In risk description, the cause is the condition or driver that could lead to the event, such as poor patch management. The event is what happens, such as a ransomware attack, and the impact is the resulting consequence, such as lost trust or a fine. Separating cause, event, and impact makes the register entry precise and supports targeted controls.

Question 15Introduction to Risk Management

A risk practitioner wants to reduce the likelihood of a fraud risk. Which action most directly addresses likelihood rather than impact?

  1. Purchasing a fidelity insurance policy
  2. Setting aside a financial reserve for losses
  3. Drafting a crisis communications plan
  4. Introducing mandatory dual authorization for payments Correct answer.

Explanation

Dual authorization adds a preventive control that makes the fraudulent act harder to carry out, which lowers likelihood. Insurance and reserves address the financial impact after an event, and a communications plan mitigates consequences rather than preventing the event. Matching the control type to likelihood or impact is central to effective treatment.

Question 16Introduction to Risk Management

What is the main purpose of applying a risk criteria statement before evaluating identified risks?

  1. To remove the need for documenting risk assessments
  2. To provide a consistent basis for judging whether a risk is acceptable Correct answer.
  3. To ensure every risk is treated with insurance
  4. To guarantee that no risk exceeds tolerance

Explanation

Risk criteria set out the terms of reference for evaluating significance, such as scales, thresholds, and acceptability. Applying them consistently lets different assessors reach comparable judgments about the same risk. Criteria guide evaluation but cannot guarantee outcomes or dictate a single treatment.

Question 17Introduction to Risk Management

An organization identifies a risk but cannot reduce it below tolerance with available controls. Which response is most consistent with CISR risk management principles?

  1. Record the risk as low and continue unchanged
  2. Escalate the decision to the appropriate authority for a documented acceptance or activity change Correct answer.
  3. Assume the risk will be handled if it occurs
  4. Delete the risk from the register to avoid reporting it

Explanation

When residual risk exceeds tolerance, the decision to accept it or change the activity must be taken at the right level of authority and documented. Escalation ensures accountability for exposures beyond delegated limits. Concealing or ignoring the risk removes the information decision-makers need.

Question 18Introduction to Risk Management

Which statement correctly describes the relationship between inherent risk, controls, and residual risk?

  1. Controls eliminate residual risk completely in all cases
  2. Residual risk is always equal to inherent risk regardless of controls
  3. Controls increase inherent risk, and residual risk is measured before controls
  4. Inherent risk is assessed before controls, and residual risk is what remains after controls operate Correct answer.

Explanation

Inherent risk reflects the exposure without regard to existing controls, while residual risk reflects the exposure once those controls are taken into account. The difference between them indicates how much the controls are achieving. Controls reduce but rarely eliminate residual risk entirely.

Question 19Introduction to Risk Management

Which of the following best explains why risk management is described as an iterative process?

  1. Because each risk is assessed exactly once and then archived
  2. Because the process only applies to financial risks
  3. Because iteration removes the need for risk owners
  4. Because risks, controls, and objectives change over time and require reassessment Correct answer.

Explanation

Objectives, operating conditions, and the effectiveness of controls change, so assessments must be repeated and updated. Iteration keeps the register and treatment decisions aligned with the current environment. It applies across risk types and does not remove the need for ownership.

Question 20Introduction to Risk Management

A risk practitioner is asked to distinguish a 'hazard' from a 'risk'. Which distinction is most accurate?

  1. A hazard is the same as a residual risk after controls
  2. A hazard exists only after an incident has occurred
  3. A hazard is a source of potential harm, while risk combines the chance and consequence of that harm Correct answer.
  4. A hazard is always a financial loss, while risk is always physical

Explanation

A hazard is a source or situation with the potential to cause harm, whereas risk expresses the likelihood and consequence of that harm occurring. The hazard is the origin; the risk is the assessed potential outcome. Treating the two as identical obscures the analysis needed to prioritize exposures.

Question 21Introduction to Risk Management

Two assessors score the same risk differently because one uses a 3-point scale and the other a 10-point scale without shared definitions. What is the most significant consequence for the risk management process?

  1. The risk owner will lose accountability for the risk
  2. The organization will be forced to use quantitative modelling
  3. The risk register will contain inconsistent scores that undermine prioritization and comparison Correct answer.
  4. The risk will automatically be removed from the register

Explanation

Inconsistent scales and undefined rating levels produce scores that cannot be compared across the register, weakening prioritization and reporting. Agreed criteria with clear descriptors for each level are needed for consistent assessment. Ownership and the choice of method are separate matters and are not automatically changed by scoring inconsistency.

Question 22Introduction to Risk Management

A risk has a low likelihood but a potentially catastrophic impact that could threaten the organization's viability. How should a practitioner treat this when applying a standard likelihood-impact matrix?

  1. Treat it exactly as a medium risk with no further consideration
  2. Recognize that the matrix may understate it and apply additional criteria for catastrophic impacts Correct answer.
  3. Assign it to the lowest band because likelihood is low
  4. Ignore it until the likelihood increases

Explanation

A simple multiplicative matrix can rank a rare but catastrophic risk below more frequent moderate risks, masking a threat to viability. Supplementary criteria, such as impact thresholds or scenario analysis, are needed to ensure such risks are escalated appropriately. Relying on the raw score alone can produce a dangerously low priority.

Question 23Introduction to Risk Management

An organization applies a control that reduces impact but leaves likelihood unchanged, and then reports the risk as fully mitigated. Why is this reporting inaccurate?

  1. Because impact-reducing controls never affect residual risk
  2. Because the risk remains possible and only its consequences have been limited, so residual likelihood persists Correct answer.
  3. Because residual risk is always higher than inherent risk
  4. Because controls can only be applied to financial risks

Explanation

A control that limits consequences, such as a business continuity plan, does not prevent the event from occurring. The risk therefore remains possible, and the residual exposure should reflect unchanged likelihood with reduced impact. Reporting the risk as fully mitigated overstates the effect of the control.

Question 24Introduction to Risk Management

Which situation best demonstrates that a risk has been transferred but not eliminated?

  1. The organization adds a preventive control that reduces likelihood
  2. The organization documents the risk in the register without action
  3. The organization buys insurance and remains responsible for uninsured portions and for the operational disruption Correct answer.
  4. The organization stops the activity that created the risk

Explanation

Transfer shifts some financial consequences to another party but does not remove the event or all of its effects. The organization still bears uninsured amounts, deductibles, and non-financial disruption such as reputational harm. Stopping the activity is avoidance, and adding a preventive control is reduction.

Question 25Introduction to Risk Management

A board asks why risk appetite should be documented rather than left implicit in management decisions. Which argument is strongest under CISR principles?

  1. Documented appetite guarantees that no risk will exceed tolerance
  2. Documented appetite removes the need for risk assessment
  3. Documented appetite gives decision-makers explicit boundaries and a basis for consistent, challengeable decisions Correct answer.
  4. Documented appetite transfers all risk to the board

Explanation

A documented appetite translates the organization's willingness to take risk into explicit boundaries that guide decisions and allow them to be challenged consistently. It supports alignment between strategy and risk-taking rather than replacing assessment. It cannot guarantee compliance with limits and does not shift ownership of risk to the board.

Question 26Introduction to Risk Management

In the CISR risk management vocabulary, what does the term 'risk appetite' refer to?

  1. The maximum financial loss that insurance policies will reimburse in a single policy year
  2. The complete set of identified risks recorded in the risk register at a given point in time
  3. The amount and type of risk an organization is willing to pursue or retain in order to meet its objectives Correct answer.
  4. The process of measuring the frequency of past incidents to forecast future losses

Explanation

Risk appetite expresses the amount and type of risk an organization is prepared to accept or pursue in pursuit of its objectives, and it guides decisions about which risks to take on. It is a forward-looking statement of willingness, distinct from the inventory of risks already recorded or from insurance limits.

Question 27Introduction to Risk Management

Which element of the risk management process establishes the scope, context, and criteria against which risks will later be assessed?

  1. Risk communication and consultation
  2. Risk treatment
  3. Risk monitoring and review
  4. Establishing the context Correct answer.

Explanation

Establishing the context sets the external and internal parameters, objectives, and risk criteria that frame the rest of the process. Assessment and treatment decisions only make sense once this framing has been agreed, which is why it comes early in the cycle.

Question 28Introduction to Risk Management

An analyst wants to record a risk in a register so that it can be managed and reviewed. Which set of attributes is most essential for that purpose?

  1. A description of the risk, its causes, its potential consequences, its owner, and its current rating Correct answer.
  2. The names of every employee who might be affected if the risk materializes
  3. The exact date on which a similar incident last occurred anywhere in the industry
  4. The vendor contract numbers for all systems involved in the process

Explanation

A usable register entry needs enough structure to support ownership and review: what the risk is, why it could happen, what the consequences would be, who owns it, and how it is currently rated. These attributes allow prioritization and tracking over time.

Question 29Introduction to Risk Management

A newly appointed risk owner is told to treat a risk but has no authority to approve spending or change procedures. Which principle does this situation most clearly violate?

  1. Risk ownership should be assigned to the person with the most technical knowledge of the process
  2. Risk ownership should be rotated among staff every quarter to spread awareness
  3. Risk ownership must carry the authority and resources needed to act on the risk Correct answer.
  4. Risk owners should always be drawn from the internal audit function

Explanation

Accountability for a risk is only meaningful when the owner can authorize the treatment actions and commit the resources required. Assigning ownership without authority leaves the risk effectively unmanaged and undermines the register's credibility.

Question 30Introduction to Risk Management

A practitioner is drafting a risk criteria scale and wants each level of impact to be interpreted consistently across business units. Which approach best achieves that?

  1. Use only numeric scores with no descriptors so that assessors are not influenced by wording
  2. Let each business unit define its own impact levels so the scale reflects local conditions
  3. Require all assessors to reach consensus on every rating in a single joint workshop
  4. Provide written descriptors and worked examples for each impact level, tied to common organizational measures Correct answer.

Explanation

Consistency comes from shared, documented descriptors and examples that anchor each level to observable organizational measures such as financial loss, regulatory breach, or service downtime. Numeric scales without anchors invite individual interpretation, and unit-specific scales prevent comparison across the organization.

Question 31Introduction to Risk Management

Why is it important to distinguish between a risk's cause, the event itself, and its consequences when writing a risk description?

  1. Because separating them lets practitioners target controls at the cause, the event, or the impact, and evaluate which is most effective Correct answer.
  2. Because regulations require exactly three sentences for every register entry
  3. Because consequences are only relevant to financial risks and not operational ones
  4. Because the event must always be recorded before the cause can be identified

Explanation

A clear cause-event-consequence structure shows where controls can intervene: preventive controls address causes, detective controls address the event, and corrective or contingency measures address consequences. Without that structure, treatment choices become arbitrary.

Question 32Introduction to Risk Management

An organization treats risk management as a one-off annual exercise, producing a register that is then filed away until the next year. Which characteristic of effective risk management is most directly missing?

  1. A dedicated risk management software platform
  2. Continuous and iterative review as conditions change Correct answer.
  3. A preference for quantitative over qualitative methods
  4. Independent external assurance of the register

Explanation

Risk management is iterative: risks, controls, and the operating environment change, so assessments must be revisited and updated. A register that is produced once and filed away cannot reflect new threats, failed controls, or shifts in appetite.

Question 33Introduction to Risk Management

A risk practitioner argues that because a control has been implemented, the risk no longer needs to appear on the register. Which reasoning error is being made?

  1. Confusing inherent risk with residual risk and assuming controls reduce residual risk to zero Correct answer.
  2. Treating every risk as if it were a compliance obligation rather than an uncertainty
  3. Believing that risk registers should only contain risks above the appetite threshold
  4. Assuming that controls always fail and therefore should never be relied upon

Explanation

Controls change the level of residual risk but rarely eliminate it entirely, so the risk remains on the register with its residual rating and any control effectiveness assumptions. Removing it confuses the effect of controls with the disappearance of the underlying uncertainty.

Question 34Introduction to Risk Management

During a lessons-learned review, an organization finds that a known risk was documented but no one acted on it before it materialized. Which weakness in the risk management framework does this most likely reveal?

  1. The assessment scale used too many levels for assessors to apply reliably
  2. The organization relied too heavily on quantitative modeling techniques
  3. The risk register lacked clear ownership and escalation routes for action Correct answer.
  4. The risk criteria were set at a level that was too strict for the business

Explanation

A documented risk that no one acts on points to a breakdown in accountability and escalation rather than in measurement. Clear ownership, review triggers, and escalation paths are what convert a register entry into timely action.

Question 35Risk Identification

In the CISR risk management framework, which statement best describes the purpose of the risk identification phase?

  1. It assigns ownership and remediation deadlines for confirmed control gaps.
  2. It determines the organization's risk appetite and tolerance thresholds.
  3. It produces a complete inventory of exposures that could affect the organization's objectives before analysis begins. Correct answer.
  4. It calculates the annualized loss expectancy for each known threat.

Explanation

Risk identification is the discovery stage: its output is a comprehensive list of events, sources, and exposures that could affect objectives. Quantification, appetite setting, and remediation ownership belong to later phases such as analysis, evaluation, and treatment.

Question 36Risk Identification

A risk practitioner is choosing an identification technique to surface rare, high-impact events that participants might not volunteer in a group setting. Which technique is designed specifically for that purpose?

  1. A review of historical incident logs from the past year
  2. A facilitated brainstorming workshop with the full risk team
  3. A Delphi exercise using anonymous, iterative expert questionnaires Correct answer.
  4. A walkthrough of the current control self-assessment checklist

Explanation

The Delphi method collects anonymous expert judgments across iterative rounds, which reduces groupthink and status pressure and helps surface outlier or minority views. Brainstorming and checklist reviews tend to reflect dominant or already-known perspectives.

Question 37Risk Identification

During risk identification, an analyst documents a supplier's bankruptcy as the event and lists the resulting production halt and customer penalties separately. What concept is the analyst applying?

  1. Performing a cost-benefit analysis of controls
  2. Aggregating risks into a single enterprise register
  3. Separating risk causes, events, and consequences Correct answer.
  4. Applying a residual risk rating before mitigation

Explanation

Structured identification distinguishes the underlying cause (supplier financial distress), the risk event (bankruptcy), and the consequences (production halt, penalties). Keeping these separate prevents confusion and supports accurate later analysis.

Question 38Risk Identification

Which activity is the clearest example of proactive risk identification rather than reactive discovery?

  1. Recording a loss after an insurer denies a claim
  2. Adding a risk to the register following a regulatory fine
  3. Logging a data breach after the security team detects exfiltration
  4. Conducting a structured scenario workshop on emerging technology adoption Correct answer.

Explanation

Proactive identification anticipates exposures before they materialize, and scenario workshops on emerging technology are forward-looking. Logging breaches, claim denials, and fines all occur after an event has already produced a loss.

Question 39Risk Identification

A risk manager wants to identify how a single process can fail at each step from input to output. Which identification approach fits this goal most directly?

  1. A key risk indicator dashboard review
  2. A strengths, weaknesses, opportunities, and threats analysis
  3. A bow-tie diagram focused on one catastrophic event
  4. A process flow analysis with failure points marked at each step Correct answer.

Explanation

Process flow analysis maps each step of an operational process and marks where failures or losses can occur, giving step-by-step coverage. SWOT, bow-tie, and indicator dashboards serve different identification or monitoring purposes.

Question 40Risk Identification

What is the primary purpose of maintaining a risk taxonomy during identification?

  1. To provide a consistent structure so exposures are captured and compared across the organization Correct answer.
  2. To record the board's approved risk appetite statement
  3. To document which controls have been tested and passed
  4. To rank risks by their calculated financial exposure

Explanation

A risk taxonomy supplies common categories and definitions, which improves completeness and lets risks from different units be compared and consolidated. It is a classification tool, not a scoring, control-testing, or appetite document.

Question 41Risk Identification

An organization identifies risks by asking front-line staff to report hazards they encounter daily. Which characteristic of effective identification does this approach most directly improve?

  1. Consistency of risk scoring across business units
  2. Alignment of the register with external audit findings
  3. Coverage of exposures observable only at the operational level Correct answer.
  4. Accuracy of the annual loss forecast

Explanation

Front-line reporting taps knowledge held by staff closest to the work, improving coverage of operational exposures that central teams may not see. It does not by itself improve loss forecasting, scoring consistency, or audit alignment.

Question 42Risk Identification

Which element must be present for an entry to qualify as a properly recorded risk in an identification register?

  1. A defined event or exposure, its cause, and its potential impact on objectives Correct answer.
  2. A quantified probability and a monetary loss estimate
  3. An approved treatment plan with target completion dates
  4. A named control owner and a tested control effectiveness rating

Explanation

A usable register entry links a cause, a risk event or exposure, and the potential effect on objectives so the risk can be understood and analyzed. Quantification, control testing, and treatment plans are added in later phases.

Question 43Risk Identification

A bank is identifying risks for a new mobile payment product. Which source would most reliably reveal exposures created by the product's reliance on third-party APIs?

  1. A contract and vendor dependency review of the API providers Correct answer.
  2. The enterprise risk register's historical operational loss entries
  3. The corporate insurance schedule
  4. The prior year's internal audit plan

Explanation

Third-party API reliance creates concentration, availability, and contractual exposures that a vendor dependency and contract review is designed to surface. Historical loss data, audit plans, and insurance schedules do not systematically examine new supplier dependencies.

Question 44Risk Identification

A facilitator runs a workshop where participants systematically imagine how a process could fail at each stage, asking 'what could go wrong and why' repeatedly. Which identification technique is being used?

  1. Fault tree analysis
  2. What-if analysis
  3. Hazard and operability study Correct answer.
  4. Monte Carlo simulation

Explanation

A hazard and operability study (HAZOP) uses guide words and structured prompts to examine each part of a process for deviations and their causes. It is more systematic than open what-if questioning and differs from fault tree modeling or probabilistic simulation.

Question 45Risk Identification

A risk team reviews industry loss data, regulatory publications, and peer incident reports to find exposures it has not yet recorded. Which identification approach does this represent?

  1. Root cause analysis
  2. Scenario stress testing
  3. Control self-assessment
  4. External loss event scanning Correct answer.

Explanation

External loss event scanning uses data and reports from outside the organization, such as industry consortia and regulators, to reveal exposures the organization may have overlooked. It complements internal sources by broadening the evidence base.

Question 46Risk Identification

During identification, a team finds that the same cyber exposure appears in the registers of five separate business units under different names. What is the most appropriate identification-quality response?

  1. Consolidate the entries into a single enterprise-level risk while preserving unit-level detail Correct answer.
  2. Leave the duplicates in place because each unit owns its own register
  3. Reclassify all five entries as accepted risks
  4. Delete four entries so only one business unit remains accountable

Explanation

Duplicate identification of one underlying exposure across units signals a need for consolidation with retained detail, so aggregation and reporting are accurate. Deleting entries loses accountability, and leaving duplicates distorts enterprise reporting.

Question 47Risk Identification

A risk analyst maps each identified risk to the organizational objective it could affect. What does this mapping most improve?

  1. The ability to prioritize identification efforts and demonstrate relevance to strategy Correct answer.
  2. The number of controls assigned to each risk
  3. The frequency of control testing
  4. The precision of the probability estimate for each risk

Explanation

Linking risks to objectives shows which exposures matter to strategy and helps focus identification where consequences are greatest. It does not itself refine probability estimates, assign controls, or set testing frequency.

Question 48Risk Identification

Which factor most commonly causes risk identification to be incomplete in a large organization?

  1. Regular refresh cycles tied to strategic planning
  2. Excessive reliance on a single functional perspective and historical data Correct answer.
  3. Inclusion of front-line and external stakeholder input
  4. Use of multiple complementary identification techniques

Explanation

Incompleteness usually stems from narrow sourcing, such as relying only on one function's view or on past losses, which misses emerging and cross-functional exposures. Combining techniques, diverse input, and regular refresh cycles all improve completeness.

Question 49Risk Identification

A firm identifies a risk that a new regulation will require costly system changes. Which classification in a standard risk taxonomy best fits this exposure?

  1. Operational process risk
  2. Strategic risk
  3. Financial market risk
  4. Compliance and regulatory risk Correct answer.

Explanation

Exposures arising from new or changed laws and the cost of conforming are classified as compliance and regulatory risk. Strategic risk concerns business direction, market risk concerns prices and rates, and operational process risk concerns execution failures.

Question 50Risk Identification

An analyst interviewing department heads notices that each describes risks only within their own function and none mentions cross-functional dependencies. What identification weakness does this reveal?

  1. Excessive aggregation of risks at the enterprise level
  2. Over-reliance on quantitative modeling
  3. Siloed perspective that misses interconnected exposures Correct answer.
  4. Premature application of residual risk ratings

Explanation

When each function reports only internal concerns, cross-boundary dependencies such as shared suppliers or linked processes go unrecorded. Identification should deliberately capture interdependencies, not just isolated functional risks.