A department has been granted an exception to bypass the existing approval process for purchase orders. The risk practitioner should verify the exception has been approved by which of the following?

• A.Senior management
• B.Risk manager
• C.Internal audit
• D.Control owner

Comment: *

Name: *

Email: *

Verification: *

If one says that the particular control or monitoring tool is sustainable, then it refers to what ability?

• A.The ability to adapt as new elements are added to the environment
• B.The ability to ensure the control remains in place when it fails
• C.The ability to protect itself from exploitation or attack
• D.The ability to be applied in same manner throughout the organization

Comment: *

Name: *

Email: *

Verification: *

An organization wants to grant remote access to a system containing sensitive data to an overseas third party. Which of the following should be of GREATEST concern to management?

• A.Lack of monitoring over vendor activities
• B.Lack of after-hours incident management support
• C.Differences in regional standards
• D.Transborder data transfer restrictions

Comment: *

Name: *

Email: *

Verification: *

Sammy is the project manager for her organization. She would like to rate each risk based on its probability and affect on time, cost, and scope. Harry, a project team member, has never done this before and thinks Sammy is wrong to attempt this approach. Harry says that an accumulative risk score should be created, not three separate risk scores. Who is correct in this scenario?

• A.Sammy is correct, because she is the project manager.
• B.Sammy is correct, because organizations can create risk scores for each objective of the project.
• C.Harry is correct, the risk probability and impact matrix is the only approach to risk assessment.
• D.Harry is correct, because the risk probability and impact considers all objectives of the project.

Comment: *

Name: *

Email: *

Verification: *

Which of the following is the BEST method for assessing control effectiveness?

• A.Ad hoc control reporting
• B.Control self-assessment
• C.Continuous monitoring
• D.Predictive analytics

Comment: *

Name: *

Email: *

Verification: *