Which of the following provides the MOST helpful reference point when communicating the results of a risk assessment to stakeholders?

• A.Risk policy
• B.Risk appetite
• C.Risk tolerance
• D.Risk awareness

Comment: *

Name: *

Email: *

Verification: *

There are five inputs to the quantitative risk analysis process. Which one of the following is NOT an input to quantitative risk analysis process?

• A.Risk management plan
• B.Enterprise environmental factors
• C.Cost management plan
• D.Risk register

Comment: *

Name: *

Email: *

Verification: *

According to the Section-302 of the Sarbanes-Oxley Act of 2002, what does certification of reports implies?
Each correct answer represents a complete solution. Choose three.

• A.The signing officer has evaluated the effectiveness of the issuer's internal controls as of a date at the time to report.
• B.The financial statement does not contain any materially untrue or misleading information.
• C.The signing officer has reviewed the report.
• D.The signing officer has presented in the report their conclusions about the effectiveness of their internal controls based on their evaluation as of that date.

Correct Answer: B,C,D

Explanation/Reference:
Explanation:
Section 302 of Sarbanes-Oxley act has the tremendous impact on the risk management solution adopted by corporations. This section specifies that the reports must be certified by the CEO, CFO, or other senior officer performing similar functions.
Certification of reports establishes:
The signing officer has reviewed the report.

The financial statement does not contain, to the knowledge of signing officer, any materially untrue or

misleading information and represent fairly all financial conditions and results of the enterprise's operations.
The signing officers:

- are responsible for establishing and maintaining internal controls
- have designed such internal controls to ensure that material information relating to the issuer and its consolidated subsidiaries is made - known to such officers by others within those entities, particularly during the period in which the periodic reports are being prepared
- have evaluated the effectiveness of the issuer's internal controls as of a date within 90 days prior to the report
- have presented in the report their conclusions about the effectiveness of their internal controls base on their evaluation as of that date The signing officer have disclosed to external auditors, audit committee, and other directors:

- all significant deficiencies in the design or operation of internal controls which could adversely affect the reliability of the reported financial data
- any fraud, whether or not material, that involves management or other employees who have a significant role in the internal controls of the enterprise The signing officer have indicated in the report any internal controls or changes to those internal

controls which have been implemented since they were evaluated.
Incorrect Answers:
A: The signing officer has evaluated the effectiveness of the issuer's internal controls as of a date within 90 days prior to the report, not at the time of the report.

Comment: *

Name: *

Email: *

Verification: *

You are the project manager of your enterprise. You have identified new threats, and then evaluated the ability of existing controls to mitigate risk associated with new threats. You noticed that the existing control is not efficient in mitigating these new risks. What are the various steps you could take in this case?
Each correct answer represents a complete solution. (Choose three.)

• A.Education of staff or business partners
• B.Deployment of a threat-specific countermeasure
• C.Modify of the technical architecture
• D.Apply more controls

Correct Answer: A,B,C

Explanation/Reference:
Explanation:
As new threats are identified and prioritized in terms of impact, the first step is to evaluate the ability of existing controls to mitigate risk associated with new threats and if it does not work then in that case facilitate the:
Modification of the technical architecture

Deployment of a threat-specific countermeasure

Implementation of a compensating mechanism or process until mitigating controls are developed

Education of staff or business partners

Incorrect Answers:
D: Applying more controls is not the good solution. They usually complicate the condition.

Comment: *

Name: *

Email: *

Verification: *

You work as a project manager for BlueWell Inc. You are about to complete the quantitative risk analysis process for your project. You can use three available tools and techniques to complete this process. Which one of the following is NOT a tool or technique that is appropriate for the quantitative risk analysis process?

• A.Data gathering and representation techniques
• B.Expert judgment
• C.Quantitative risk analysis and modeling techniques
• D.Organizational process assets

Correct Answer: D

Explanation/Reference:
Explanation:
Organizational process asset is not a tool and technique, but an input to the quantitative risk analysis process. Quantitative Risk Analysis is a process to assess the probability of achieving particular project objectives, to quantify the effect of risks on the whole project objective, and to prioritize the risks based on the impact to overall project risk. Quantitative Risk Analysis process analyzes the affect of a risk event deriving a numerical value. It also presents a quantitative approach to build decisions in the presence of uncertainty. The inputs for Quantitative Risk Analysis are:
Organizational process assets

Project Scope Statement

Risk Management Plan

Risk Register

Project Management Plan

Incorrect Answers:
A: Data gathering and representation technique is a tool and technique for the quantitative risk analysis process.
B: Expert judgment is a tool and technique for the quantitative risk analysis process.
C: Quantitative risk analysis and modeling techniques is a tool and technique for the quantitative risk analysis process.

Comment: *

Name: *

Email: *

Verification: *