Download Certified in Risk and Information Systems Control.CRISC.TestKing.2019-01-22.252q.vcex

All identified risk events should be entered into the risk register. A risk register is an inventory of risks and exposure associated with those risks. Risks are commonly found in project management practices, and provide information to identify, analyze, and manage risks. Typically a risk register contains:A description of the risk The impact should this event actually occur The probability of its occurrence Risk Score (the multiplication of Probability and Impact) A summary of the planned response should the event occur A summary of the mitigation (the actions taken in advance to reduce the probability and/or impact of the event) Ranking of risks by Risk Score so as to highlight the highest priority risks to all involved. Incorrect Answers:A: Before the risk events are analyzed they should be documented in the risk register.B: The risks should first be documented and analyzed.D: These risks should first be identified, documented, passed through qualitative risk analysis and then it should be determined if they should pass through the quantitative risk analysis process.

Each business process involves inherent risk. Not engaging in any activity avoids the inherent risk associated with the activity. Hence this demonstrates risk avoidance. Incorrect Answers:B: Risk treatment means that action is taken to reduce the frequency and impact of a risk.C: Acceptance means that no action is taken relative to a particular risk, and loss is accepted when/if it occurs. This is different from being ignorant of risk; accepting risk assumes that the risk is known, i.e., an informed decision has been made by management to accept it as such.D: Risk transfer/sharing means reducing either risk frequency or impact by transferring or otherwise sharing a portion of the risk. Common techniques include insurance and outsourcing. These techniques do not relieve an enterprise of a risk, but can involve the skills of another party in managing the risk and reducing the financial consequence if an adverse event occurs.

The risk components defined by the COSO ERM are internal environment, objective settings, event identification, risk assessment, risk response, control objectives, information and communication, and monitoring. Incorrect Answers:C: Business continuity is not considered as risk component within the ERM framework.

The outcome of quantitative analysis can create a listing of prioritized risks that should be updated in the risk register. The project team will create and update the risk register with four key components:probabilistic analysis of the project probability of achieving time and cost objectives list of quantified risks trends in quantitative risk analysis Incorrect Answers:A, B, D: These subjects are not updated in the risk register as a result of quantitative risk analysis.

There is only one tool and technique available for Fred to plan risk management: planning meetings and analysis. Planning Meeting and Analysis is a tool and technique in the Plan Risk Management process. Planning meetings are organized by the project teams to develop the risk management plan. Attendees at these meetings include the following:Project manager Selected project team members Stakeholders Anybody in the organization with the task to manage risk planning  Sophisticated plans for conducting the risk management activities are defined in these meetings, responsibilities related to risk management are assigned, and risk contingency reserve application approaches are established and reviewed. Incorrect Answers:A, B, D: These are not plan risk management tools and techniques.

There is an increased risk without a policy defining who has the responsibility for granting access to specific data or systems, as one could gain system access without a justified business needs. There is better chance that business objectives will be properly supported when there is appropriate ownership. Incorrect Answers:A, B, D: These risks are not such significant as compared to unauthorized access.

Secondary risks are the risks that come about as a result of implementing a risk response. This new risk event must be recorded, analyzed, and planned for management. Incorrect Answers:A: A residual risk event is similar to a secondary risk, but is often small in probability and impact, so it may just be accepted.C: Infinitive risk is not a valid project management term.D: Populated risk event is not a valid project management term.

Risk register update is the only output of the choices presented for the qualitative risk analysis process. The four inputs for the qualitative risk analysis process are the risk register, risk management plan, project scope statement, and organizational process assets. The output of perform qualitative risk analysis process is Risk Register Updates. Risk register is updated with the information from perform qualitative risk analysis and the updated risk register is included in the project documents. Updates include the following important elements:Relative ranking or priority list of project risks Risks grouped by categories Causes of risk or project areas requiring particular attention List of risks requiring response in the near-term List of risks for additional analysis and response Watchlist of low priority risks Trends in qualitative risk analysis results Incorrect Answers:A, C, D: These are not the valid outputs for the qualitative risk analysis process.

Inspection of FISMA is required to be done annually. Each year, agencies must have an independent evaluation of their program. The objective is to determine the effectiveness of the program. These evaluations include:Testing for effectiveness: Policies, procedures, and practices are to be tested. This evaluation does not test every policy, procedure, and practice. Instead, a representative sample is tested.An assessment or report: This report identifies the agency's compliance as well as lists compliance with FISMA. It also lists compliance with other standards and guidelines.Incorrect Answers:B, C, D: Auditing of compliance by external organization is done annually, not quarterly or every three years.

The foremost root cause of project risk is:A lack of discipline in managing the software development process Selection of a project methodology that is unsuitable to the system being developed Incorrect Answers:A: The risk associated with new system is not meeting the user business needs is business risks, not project risk.B: This is not direct reason of project risk.