Which of the following processes is described in the statement below?
"It is the process of exchanging information and views about risks among stakeholders, such as groups, individuals, and institutions."

• A.Risk governance
• B.Risk identification
• C.Risk response planning
• D.Risk communication

Correct Answer: D

Explanation/Reference:
Explanation:
Risk communication is the process of exchanging information and views about risks among stakeholders, such as groups, individuals, and institutions. Risk communication is mostly concerned with the nature of risk or expressing concerns, views, or reactions to risk managers or institutional bodies for risk management. The key plan to consider and communicate risk is to categorize and impose priorities, and acquire suitable measures to reduce risks. It is important throughout any crisis to put across multifaceted information in a simple and clear manner.
Risk communication helps in switching or allocating the information concerning risk among the decision- maker and the stakeholders. Risk communication can be explained more clearly with the help of the following definitions:
It defines the issue of what a group does, not just what it says.

It must take into account the valuable element in user's perceptions of risk.

It will be more valuable if it is thought of as conversation, not instruction.

Risk communication is a fundamental and continuing element of the risk analysis exercise, and the involvement of the stakeholder group is from the beginning. It makes the stakeholders conscious of the process at each phase of the risk assessment. It helps to guarantee that the restrictions, outcomes, consequence, logic, and risk assessment are undoubtedly understood by all the stakeholders.
Incorrect Answers:
C: A risk response ensures that the residual risk is within the limits of the risk appetite and tolerance of the enterprise. Risk response is process of selecting the correct, prioritized response to risk, based on the level of risk, the enterprise's risk tolerance and the cost and benefit of the particular risk response option.
Risk response ensures that management is providing accurate reports on:
The level of risk faced by the enterprise

The incidents' type that have occurred

Any alteration in the enterprise's risk profile based on changes in the risk environment

Comment: *

Name: *

Email: *

Verification: *

You are the project manager of your enterprise. You have identified new threats, and then evaluated the ability of existing controls to mitigate risk associated with new threats. You noticed that the existing control is not efficient in mitigating these new risks. What are the various steps you could take in this case?
Each correct answer represents a complete solution. Choose all that apply.

• A.Education of staff or business partners
• B.Deployment of a threat-specific countermeasure
• C.Modify of the technical architecture
• D.Apply more controls
• E.Explanation:
  As new threats are identified and prioritized in terms of impact, the first step is to evaluate the ability of existing controls to mitigate risk associated with new threats and if it does not work then in that case facilitate the: Modification of the technical architecture Deployment of a threat-specific countermeasure Implementation of a compensating mechanism or process until mitigating controls are developed Education of staff or business partners

Comment: *

Name: *

Email: *

Verification: *

Which of the following presents the GREATEST risk to change control in business application development over the complete life cycle?

• A.Bypassing quality requirements before go-live
• B.Introduction of requirements that have not been approved
• C.Emphasis on multiple application testing cycles
• D.Lack of an integrated development environment (IDE) tool

Comment: *

Name: *

Email: *

Verification: *

A payroll manager discovers that fields in certain payroll reports have been modified without authorization.
Which of the following control weaknesses could have contributed MOST to this problem?

• A.Payroll files were not under the control of a librarian.
• B.The programmer had access to the production programs.
• C.The programmer did not involve the user in testing.
• D.The user requirements were not documented.

Comment: *

Name: *

Email: *

Verification: *

A risk owner has identified a risk with high impact and very low likelihood. The potential loss is covered by insurance. Which of the following should the risk practitioner do NEXT?

• A.Evaluate outsourcing the process.
• B.Recommend avoiding the risk.
• C.Update the risk register.
• D.Validate the risk response with internal audit.

Comment: *

Name: *

Email: *

Verification: *