UESTION NO:
The PRIMARY benefit associated with key risk indicators (KRls) is that they

• A.help an organization identify emerging threats.
• B.enable ongoing monitoring of emerging risk.
• C.benchmark the organization's risk profile.
• D.identify trends in the organization's vulnerabilities.

Comment: *

Name: *

Email: *

Verification: *

When collecting information to identify IT-related risk, a risk practitioner should FIRST focus on IT:

• A.security policies.
• B.process maps.
• C.risk tolerance level,
• D.risk appetite.

Comment: *

Name: *

Email: *

Verification: *

You are the project manager of your enterprise. While performing risk management, you are given a task to identify where your enterprise stand in certain practice and also to suggest the priorities for improvements. Which of the following models would you use to accomplish this task?

• A.Capability maturity model
• B.Decision tree model
• C.Fishbone model
• D.Simulation tree model

Correct Answer: A

Explanation/Reference:
Explanation:
Capability maturity models are the models that are used by the enterprise to rate itself in terms of the least mature level (having nonexistent or unstructured processes) to the most mature (having adopted and optimized the use of good practices).
The levels within a capability maturity model are designed to allow an enterprise to identify descriptions of its current and possible future states. In general, the purpose is to:
Identify, where enterprises are in relation to certain activities or practices.

Suggest how to set priorities for improvements

Incorrect Answers:
D: There is no such model exists in risk management process.
B: Decision tree analysis is a risk analysis tool that can help the project manager in determining the best risk response. The tool can be used to measure probability, impact, and risk exposure and how the selected risk response can affect the probability and/or impact of the selected risk event. It helps to form a balanced image of the risks and opportunities connected with each possible course of action. This makes them mostly useful for choosing between different strategies, projects, or investment opportunities particularly when the resources are limited. A decision tree is a decision support tool that uses a tree-like graph or model of decisions and their possible consequences, including chance event outcomes, resource costs, and utility.
C: Fishbone diagrams or Ishikawa diagrams shows the relationships between the causes and effects of problems.

Comment: *

Name: *

Email: *

Verification: *

You are the risk official in Bluewell Inc. You are supposed to prioritize several risks. A risk has a rating for occurrence, severity, and detection as 4, 5, and 6, respectively. What Risk Priority Number (RPN) you would give to it?

• A.120
• B.100
• C.15
• D.30

Correct Answer: A

Explanation/Reference:
Explanation:
Steps involving in calculating risk priority number are as follows:
Identify potential failure effects

Identify potential causes

Establish links between each identified potential cause

Identify potential failure modes

Assess severity, occurrence and detection

Perform score assessments by using a scale of 1 -10 (low to high rating) to score these assessments.

Compute the RPN for a particular failure mode as Severity multiplied by occurrence and detection.

RPN = Severity * Occurrence * Detection
Hence,
RPN = 4 * 5 * 6
= 120
Incorrect Answers:
B, C, D: These are not RPN for given values of severity, occurrence, and detection.

Comment: *

Name: *

Email: *

Verification: *

Which of the following is the PRIMARY objective for automating controls?

• A.Improving control process efficiency
• B.Reducing the need for audit reviews
• C.Facilitating continuous control monitoring
• D.Complying with functional requirements

Comment: *

Name: *

Email: *

Verification: *