Download Certified in Risk and Information Systems Control.CRISC.Test4Prep.2019-12-04.389q.vcex

The risk responses that do not exist up till then, should be included in the organization's lessons learned database so other project managers can use these responses in their project if relevant. Incorrect Answers:A: The responses are not in the project management plan, but in the risk response plan during the project and they'll be entered into the organization's lessons learned database.B: The risk responses are included in the risk response plan, but after completing the project, they should be entered into the organization's lessons learned database.D: If the new responses that were identified is only included in the project's risk register then it may not be shared with project managers working on some other project.

This risk event has the potential to save money on project costs, so it is an opportunity, and the appropriate strategy to use in this case is the exploit strategy. The exploit response is one of the strategies to negate risks or threats appear in a project. This strategy may be selected for risks with positive impacts where the organization wishes to ensure that the opportunity is realized. Exploiting a risk event provides opportunities for positive impact on a project. Assigning more talented resources to the project to reduce the time to completion is an example of exploit response. Incorrect Answers:A, C: Mitigation and avoidance risk response is used in case of negative risk events, and not in positive risk events. Here in this scenario, as it is stated that the event could save $100,000, hence it is a positive risk event. Therefore should not be mitigated or avoided.B: To accept risk means that no action is taken relative to a particular risk; loss is accepted if it occurs. But as this risk event bring an opportunity, it should me exploited and not accepted.

An enterprise may have hundreds of risk indicators such as logs, alarms and reports. The CRISC will usually need to work with senior management and business leaders to determine which risk indicators will be monitored on a regular basis and be recognized as KRIs. Incorrect Answers:C, D: Chief financial officer and human resource only overview common risk view, but are not involved in risk based decisions.

The Communications Management Plan defines, in regard to risk management, who will be available to share information on risks and responses throughout the project. The Communications Management Plan aims to define the communication necessities for the project and how the information will be circulated. The Communications Management Plan sets the communication structure for the project. This structure provides guidance for communication throughout the project's life and is updated as communication needs change. The Communication Managements Plan identifies and defines the roles of persons concerned with the project. It includes a matrix known as the communication matrix to map the communication requirements of the project. Incorrect Answers:A: The Resource Management Plan does not define risk communications.B: The Risk Management Plan defines risk identification, analysis, response, and monitoring.C: The stakeholder management strategy does not address risk communications.

Physical security is an example of non-technical control. It comes under the family of operational controls. Incorrect Answers:A, C, D: Intrusion detection system, access control, and encryption are the safeguards that are incorporated into computer hardware, software or firmware, hence they refer to as technical controls.

Decision tree diagrams are used during the Quantitative risk analysis process and not in risk identification. Incorrect Answers:A, B, C: All these options are diagrammatical techniques used in the Identify risks process.

The utility of the risk describes the usefulness of a particular risk to an individual. Moreover, the same risk can be utilized by two individuals in different ways. Financial outcomes are one of the methods for measuring potential value for taking a risk. For example, if the individual's economic wealth increases, the potential utility of the risk will decrease. Incorrect Answers:A: Determining financial incentive is one of the method to measure the potential value for taking a risk, but it is not the valid definition for utility of risk.B: It is not the valid definition.C: It is not the valid definition.

Moderate risks are noticeable failure threatening the success of certain goals. Incorrect Answers:B: High risk is the significant failure impacting in certain goals not being met.C: Extremely high risk are the risks that has large impact on enterprise and are most likely results in failure with severe consequences.D: Low risks are the risk that results in certain unsuccessful goals.

Risk communication is the process of exchanging information and views about risks among stakeholders, such as groups, individuals, and institutions. Risk communication is mostly concerned with the nature of risk or expressing concerns, views, or reactions to risk managers or institutional bodies for risk management. The key plan to consider and communicate risk is to categorize and impose priorities, and acquire suitable measures to reduce risks. It is important throughout any crisis to put across multifaceted information in a simple and clear manner. Risk communication helps in switching or allocating the information concerning risk among the decision-maker and the stakeholders. Risk communication can be explained more clearly with the help of the following definitions:It defines the issue of what a group does, not just what it says. It must take into account the valuable element in user's perceptions of risk. It will be more valuable if it is thought of as conversation, not instruction. Risk communication is a fundamental and continuing element of the risk analysis exercise, and the involvement of the stakeholder group is from the beginning. It makes the stakeholders conscious of the process at each phase of the risk assessment. It helps to guarantee that the restrictions, outcomes, consequence, logic, and risk assessment are undoubtedly understood by all the stakeholders. Incorrect Answers:C: A risk response ensures that the residual risk is within the limits of the risk appetite and tolerance of the enterprise. Risk response is process of selecting the correct, prioritized response to risk, based on the level of risk, the enterprise's risk tolerance and the cost and benefit of the particular risk response option.Risk response ensures that management is providing accurate reports on:The level of risk faced by the enterprise The incidents' type that have occurred Any alteration in the enterprise's risk profile based on changes in the risk environment

The primary outputs from Identify Risks are the initial entries into the risk register. The risk register ultimately contains the outcomes of other risk management processes as they are conducted, resulting in an increase in the level and type of information contained in the risk register over time. Incorrect Answers:B, C, D: All these are outputs from the "Plan Risk Management" process, which happens prior to the starting of risk identification.