Which of the following is BEST described by the definition below?
"They are heavy influencers of the likelihood and impact of risk scenarios and should be taken into account during every risk analysis, when likelihood and impact are assessed."

• A.Obscure risk
• B.Risk factors
• C.Risk analysis
• D.Risk event

Correct Answer: B

Explanation/Reference:
Explanation:
Risk factors are those features that influence the likelihood and/or business impact of risk scenarios. They have heavy influences on probability and impact of risk scenarios. They should be taken into account during every risk analysis, when likelihood and impact are assessed.
Incorrect Answers:
A: The enterprise must consider risk that has not yet occurred and should develop scenarios around unlikely, obscure or non-historical events.
Such scenarios can be developed by considering two things:
Visibility

Recognition

For the fulfillment of this task enterprise must:
Be in a position that it can observe anything going wrong

Have the capability to recognize an observed event as something wrong

C: A risk analysis involves identifying the most probable threats to an organization and analyzing the related vulnerabilities of the organization to these threats. A risk from an organizational perspective consists of:
Threats to various processes of organization.

Threats to physical and information assets.

Likelihood and frequency of occurrence from threat.

Impact on assets from threat and vulnerability.

Risk analysis allows the auditor to do the following tasks:
Identify threats and vulnerabilities to the enterprise and its information system.

Provide information for evaluation of controls in audit planning.

Aids in determining audit objectives.

Supporting decision based on risks.

D: A risk event represents the situation where you have a risk that only occurs with a certain probability and where the risk itself is represented by a specified distribution.

Comment: *

Name: *

Email: *

Verification: *

Which of the following provides the MOST useful information to determine risk exposure following control implementations?

• A.Strategic plan and risk management integration
• B.Risk limits, thresholds, and indicators
• C.Risk escalation and process for communication
• D.Policies, standards, and procedures

Comment: *

Name: *

Email: *

Verification: *

Which of the following is the way to verify control effectiveness?

• A.The capability of providing notification of failure.
• B.Whether it is preventive or detective.
• C.Its reliability.
• D.The test results of intended objectives.
• E.Explanation:
  Control effectiveness requires a process to verify that the control process worked as intended and
  meets the intended control objectives.
  Hence the test result of intended objective helps in verifying effectiveness of control.
• F.is incorrect. Reliability is not an indication of control strength; weak controls can be
  highly reliable, even if they do not meet the control objective.
• G.is incorrect. The type of control, like preventive or detective, does not help determine
  control effectiveness.

Comment: *

Name: *

Email: *

Verification: *

An organization is planning to move its application infrastructure from on-premises to the cloud. Which of the following is the BEST course of the actin to address the risk associated with data transfer if the relationship is terminated with the vendor?

• A.Ensure the language in the contract explicitly states who is accountable for each step of the data transfer process
• B.Collect requirements for the environment to ensure the infrastructure as a service (IaaS) is configured appropriately.
• C.Meet with the business leaders to ensure the classification of their transferred data is in place
• D.Work closely with the information security officer to ensure the company has the proper security controls in place.

Comment: *

Name: *

Email: *

Verification: *

You are the risk professional in Bluewell Inc. A risk is identified and enterprise wants to quickly implement control by applying technical solution that deviates from the company's policies. What you should do?

• A.Recommend against implementation because it violates the company's policies
• B.Recommend revision of the current policy
• C.Recommend a risk assessment and subsequent implementation only if residual risk is accepted
• D.Conduct a risk assessment and allow or disallow based on the outcome

Comment: *

Name: *

Email: *

Verification: *