CRISC. Set it up and run it.

1. Refer to the exhibit. A practitioner reviews this risk register entry before the quarterly report. What is the MOST significant deficiency in the record as shown?

• A. The inherent rating is higher than the residual rating
• B. No accountable risk owner is recorded
• C. The treatment approach is set to mitigate
• D. The description mentions an internet-facing server

Correct answer: B. A register entry with no named risk owner has no one accountable to drive or accept the treatment, which is the most significant deficiency because ownership is what makes the recorded risk actionable and answerable.

Why the others are wrong. An inherent rating exceeding the residual rating is normal and expected, showing controls have reduced exposure. A mitigate treatment is a legitimate response choice, not a defect. The description of an internet-facing server is appropriate risk detail, so none of these are deficiencies compared with the missing accountable owner.

2. An enterprise is integrating risk management into its strategic planning process. Which practices BEST support alignment of risk activities with business objectives? (Choose two.)

• A. Delegating all risk decisions to the security team
• B. Mapping key risk scenarios to specific strategic objectives
• C. Reviewing risk appetite whenever strategic priorities change
• D. Assessing risk only after initiatives are fully deployed
• E. Excluding business owners from risk workshops to save time

Correct answer: B. Mapping risk scenarios to objectives and revisiting risk appetite as priorities shift both keep risk management tied to what the business is trying to achieve, ensuring risk information stays relevant to strategic decision making.

Why the others are wrong. Delegating all decisions to the security team removes business ownership of risk. Assessing risk only after deployment is too late to influence strategy. Excluding business owners from workshops severs the very alignment being sought, since the owners hold the objectives and accept the resulting risk.

3. Senior management is defining how information risk management should support the enterprise's growth strategy. What is the PRIMARY reason to align risk management with business objectives?

• A. To ensure risk decisions support achievement of enterprise objectives
• B. To reduce the number of controls the enterprise must operate
• C. To eliminate all risk from strategic initiatives
• D. To transfer accountability for risk to the audit function

Correct answer: A. Risk management exists to help the enterprise meet its objectives; aligning it with business strategy ensures that risk decisions enable rather than obstruct the outcomes leadership is pursuing, keeping resources focused on what matters most.

Why the others are wrong. Reducing the number of controls is an operational side effect, not the purpose of alignment. Eliminating all risk is impossible and would stall growth entirely. Transferring accountability to audit confuses assurance with ownership, since business owners, not auditors, own and accept risk.

4. In precise ISACA terminology, a weakness or deficient condition in a process, system, or control that could be exploited to cause harm is called what?

• A. A threat
• B. A risk
• C. A threat actor
• D. A vulnerability

Correct answer: D. A vulnerability is precisely a weakness or deficient condition that a threat can exploit; ISACA keeps this term distinct from a threat, which is the harmful actor or event, and from risk, which is the resulting uncertainty to objectives.

Why the others are wrong. A threat is something capable of causing harm, such as an actor or event, not the weakness itself. A risk is the uncertainty to objectives that results when a threat exploits a weakness. A threat actor is the specific source acting against the weakness, again distinct from the deficient condition described here.

5. An enterprise purchases a cyber-insurance policy to offset potential financial losses from a data breach it cannot fully prevent. Which risk response does this BEST represent?

• A. Risk avoidance
• B. Risk transfer or sharing
• C. Risk mitigation
• D. Risk acceptance

Correct answer: B. Buying insurance shifts the financial consequence of a loss event to a third party while the enterprise continues the activity, which is the defining characteristic of transferring or sharing risk rather than reducing or eliminating it.

Why the others are wrong. Avoidance would mean stopping the activity that creates the exposure, which is not happening here. Mitigation would reduce likelihood or impact through controls, but a policy pays after the fact. Acceptance would mean taking no action and retaining the full consequence, whereas insurance deliberately moves the financial burden elsewhere.

6. A newly appointed risk practitioner finds that the risk management function reports directly to the CIO. What is the GREATEST concern this reporting line creates?

• A. Risk reports will be produced more slowly than before
• B. The CIO will have too little visibility into technology risk
• C. Risk oversight may lose independence from the technology it assesses
• D. The risk function will duplicate work performed by internal audit

Correct answer: C. When the risk function reports to the executive whose domain it evaluates, its independence and objectivity are compromised, because unfavorable findings about IT may be filtered or suppressed before reaching the board that needs them.

Why the others are wrong. Slower reporting is a process issue, not the structural governance flaw here. The CIO already has visibility into technology risk, so that is not the concern. Duplicating audit work is unrelated to the reporting line, which is fundamentally about the loss of independent oversight over IT.

7. A hurricane that could disrupt a data center, a disgruntled employee, and malware are all examples of which risk element under ISACA's precise definitions?

• A. Vulnerabilities
• B. Threats
• C. Controls
• D. Residual risks

Correct answer: B. Each item listed is a source or event capable of causing harm, which is exactly ISACA's definition of a threat; none of them is a weakness, a safeguard, or the leftover uncertainty that remains after treatment.

Why the others are wrong. Vulnerabilities are the weaknesses that these threats might exploit, not the harmful sources themselves. Controls are safeguards that reduce risk, the opposite of harmful agents. Residual risks describe the uncertainty remaining after controls are applied, which is unrelated to naming the harmful events and actors presented in the list.

8. Management decides to discontinue a new online payment feature entirely because the associated fraud exposure clearly exceeds what the enterprise is willing to bear. This decision BEST reflects which response?

• A. Risk acceptance
• B. Risk mitigation
• C. Risk avoidance
• D. Risk transfer

Correct answer: C. Eliminating the activity that generates the exposure so that the risk can no longer materialize is the essence of avoidance, chosen here because the exposure sits beyond the enterprise's appetite and cannot be economically reduced.

Why the others are wrong. Acceptance would retain the feature and its exposure, the opposite of the action taken. Mitigation would keep the feature while adding controls to lower the risk. Transfer would keep the feature and shift the loss to an insurer or partner, none of which describes shutting the activity down.