CA Foundation Business Economics Questions 2023 - Part 32
Fri, 03 Mar 2023
Inspirational journeys
Follow the stories of academics and their research expeditions
CRISC—Certified in Risk and Information Systems Control Certification Questions and answer - Part 31
1. Which of the following is NOT true for Key Risk Indicators?
A) They are selected as the prime monitoring indicators for the enterprise
B) They help avoid having to manage and report on an excessively large number of risk indicators
C) The complete set of KRIs should also balance indicators for risk, root causes and business impact.
D) They are monitored annually
2. What are the responsibilities of the CRO?Each correct answer represents a complete solution. Choose three.(Select 3answers)
A) Managing the supporting risk management function
B) Managing the risk assessment process
C) Advising Board of Directors
D) Implement corrective actions
3. You are the project manager of the GHT project. You are accessing data for further analysis. You have chosen such a data extraction method in which management monitors its own controls. Which of the following data extraction methods you are using here?
A) Extracting data directly from the source systems after system owner approval
B) Extracting data from the system custodian (IT) after system owner approval
C) Extracting data from risk register
D) Extracting data from lesson learned register
4. You are the project manager for your organization to install new workstations, servers, and cabling throughout a new building, where your company will be moving into. The vendor for the project informs you that the cost of the cabling has increased due to the some reason. This new cost will cause the cost of your project to increase by nearly eight percent. What change control system should the costs be entered into for review?
A) Cost change control system
B) Contract change control system
C) Scope change control system
D) Only changes to the project scope should pass through a change control system.
5. When a risk cannot be sufficiently mitigated through manual or automatic controls, which of the following options will BEST protect the enterprise from the potential financial impact of the risk?
A) Updating the IT risk registry
B) Insuring against the risk
C) Outsourcing the related business process to a third party
D) Improving staff-training in the risk area
A) They are selected as the prime monitoring indicators for the enterprise
B) They help avoid having to manage and report on an excessively large number of risk indicators
C) The complete set of KRIs should also balance indicators for risk, root causes and business impact.
D) They are monitored annually
2. What are the responsibilities of the CRO?Each correct answer represents a complete solution. Choose three.(Select 3answers)
A) Managing the supporting risk management function
B) Managing the risk assessment process
C) Advising Board of Directors
D) Implement corrective actions
3. You are the project manager of the GHT project. You are accessing data for further analysis. You have chosen such a data extraction method in which management monitors its own controls. Which of the following data extraction methods you are using here?
A) Extracting data directly from the source systems after system owner approval
B) Extracting data from the system custodian (IT) after system owner approval
C) Extracting data from risk register
D) Extracting data from lesson learned register
4. You are the project manager for your organization to install new workstations, servers, and cabling throughout a new building, where your company will be moving into. The vendor for the project informs you that the cost of the cabling has increased due to the some reason. This new cost will cause the cost of your project to increase by nearly eight percent. What change control system should the costs be entered into for review?
A) Cost change control system
B) Contract change control system
C) Scope change control system
D) Only changes to the project scope should pass through a change control system.
5. When a risk cannot be sufficiently mitigated through manual or automatic controls, which of the following options will BEST protect the enterprise from the potential financial impact of the risk?
A) Updating the IT risk registry
B) Insuring against the risk
C) Outsourcing the related business process to a third party
D) Improving staff-training in the risk area
1. Right Answer: D
Explanation: They are monitored on regular basis as they indicate high probability and high impact risks. As risks change over time, hence KRIs should also be monitored regularly for its effectiveness on these changing risks.Incorrect Answers:A, B, C: These all are true for KRIs. Key Risk Indicators are the prime monitoring indicators of the enterprise. KRIs are highly relevant and possess a high probability of predicting or indicating important risk. KRIs help in avoiding excessively large number of risk indicators to manage and report that a large enterprise may have.The complete set of KRIs should also balance indicators for risk, root causes and business impact, so as to indicate the risk and its impact completely.
2. Right Answer: A,B,D
Explanation: Chief Risk Officer is the executive-level manager in an organization. They provide corporate, guidance, governance, and oversight over the enterprise's risk management activities. The main priority for the CRO is to ensure that the organization is in full compliance with applicable regulations. They may also deal with areas regarding insurance, internal auditing, corporate investigations, fraud, and information security.CRO's responsibilities include: Managing the risk assessment process Implementation of corrective actions Communicate risk management issues Supporting the risk management functions
3. Right Answer: A
Explanation: Direct extraction from the source system involves management monitoring its own controls, instead of auditors/third parties monitoring management's controls. It is preferable over extraction from the system custodian.Incorrect Answers:B: Extracting data from the system custodian (IT) after system owner approval, involves auditors or third parties monitoring management's controls. Here, in this management does not monitors its own control.C, D: These are not data extraction methods.
4. Right Answer: A
Explanation: Because this change deals with the change of the deliverable, it should pass through the cost change control system. The cost change control system reviews the reason why the change has happened, what the cost affects, and how the project should respond.Incorrect Answers:B: This is not a contract change. According to the evidence that a contract exists or that the cost of the materials is outside of the terms of a contract if one existed.Considered a time and materials contract where a change of this nature could be acceptable according to the terms of the contract. If the vendor wanted to change the terms of the contract then it would be appropriate to enter the change into the contract change control system.C: The scope of the project will not change due to the cost of the materials.D: There are four change control systems that should always be entertained for change: schedule, cost, scope, and contract.
5. Right Answer: B
Explanation: An insurance policy can compensate the enterprise up to 100% by transferring the risk to another company. Hence in this stem risk is being transferred.Incorrect Answers:A: Updating the risk registry (with lower values for impact and probability) will not actually change the risk, only management's perception of it.C: Outsourcing the process containing the risk does not necessarily remove or change the risk. While on other hand, insurance will completely remove the risk.D: Staff capacity to detect or mitigate the risk may potentially reduce the financial impact, but insurance allows for the risk to be mitigated up to 100%.
Explanation: They are monitored on regular basis as they indicate high probability and high impact risks. As risks change over time, hence KRIs should also be monitored regularly for its effectiveness on these changing risks.Incorrect Answers:A, B, C: These all are true for KRIs. Key Risk Indicators are the prime monitoring indicators of the enterprise. KRIs are highly relevant and possess a high probability of predicting or indicating important risk. KRIs help in avoiding excessively large number of risk indicators to manage and report that a large enterprise may have.The complete set of KRIs should also balance indicators for risk, root causes and business impact, so as to indicate the risk and its impact completely.
2. Right Answer: A,B,D
Explanation: Chief Risk Officer is the executive-level manager in an organization. They provide corporate, guidance, governance, and oversight over the enterprise's risk management activities. The main priority for the CRO is to ensure that the organization is in full compliance with applicable regulations. They may also deal with areas regarding insurance, internal auditing, corporate investigations, fraud, and information security.CRO's responsibilities include: Managing the risk assessment process Implementation of corrective actions Communicate risk management issues Supporting the risk management functions
3. Right Answer: A
Explanation: Direct extraction from the source system involves management monitoring its own controls, instead of auditors/third parties monitoring management's controls. It is preferable over extraction from the system custodian.Incorrect Answers:B: Extracting data from the system custodian (IT) after system owner approval, involves auditors or third parties monitoring management's controls. Here, in this management does not monitors its own control.C, D: These are not data extraction methods.
4. Right Answer: A
Explanation: Because this change deals with the change of the deliverable, it should pass through the cost change control system. The cost change control system reviews the reason why the change has happened, what the cost affects, and how the project should respond.Incorrect Answers:B: This is not a contract change. According to the evidence that a contract exists or that the cost of the materials is outside of the terms of a contract if one existed.Considered a time and materials contract where a change of this nature could be acceptable according to the terms of the contract. If the vendor wanted to change the terms of the contract then it would be appropriate to enter the change into the contract change control system.C: The scope of the project will not change due to the cost of the materials.D: There are four change control systems that should always be entertained for change: schedule, cost, scope, and contract.
5. Right Answer: B
Explanation: An insurance policy can compensate the enterprise up to 100% by transferring the risk to another company. Hence in this stem risk is being transferred.Incorrect Answers:A: Updating the risk registry (with lower values for impact and probability) will not actually change the risk, only management's perception of it.C: Outsourcing the process containing the risk does not necessarily remove or change the risk. While on other hand, insurance will completely remove the risk.D: Staff capacity to detect or mitigate the risk may potentially reduce the financial impact, but insurance allows for the risk to be mitigated up to 100%.
Tags:
it certification certified it it exams isaca certification isaca cgeit isaca cisa isaca cism isaca cobit 5 isaca crisc isaca questions practice exams pratice quests risc maangement it management it questions isaca answers isaca practice isaca dumps isaca test test questions questins and answer explanation0 Comments
Categories
Recent posts
CA Foundation Business Economics Questions 2023 - Part 31
Fri, 03 Mar 2023
CA Foundation Business Economics Questions 2023 - Part 30
Fri, 03 Mar 2023
Leave a comment