Governance — CRISC Practice Questions

A public‑sector agency is aligning its ERM program with OMB Circular A‑123. Which statement best reflects the purpose of ERM according to OMB?

• A.To address risks in isolated silos, treating each separately
• B.To view risks as an interrelated portfolio impacting mission
• C.To isolate financial risks within a single dedicated department
• D.To delegate risk decisions primarily to line managers across units

Why: ERM should treat risks as an integrated portfolio that influences mission achievement OMB Circular A‑123 states ERM is an "effective agency‑wide approach…by understanding the combined impact of risks as an interrelated portfolio"

After a merger, two distinct asset registries exist. What is the best initial governance step to achieve a unified asset management system?

• A.Merge the registries and de‑duplicate records immediately
• B.Establish a cross‑functional steering committee to define a unified asset taxonomy
• C.Perform a gap analysis between the two registries to identify missing asset types
• D.Mandate that all future assets be recorded only in the acquiring company’s system

Why: Create governance structure to define consistent asset taxonomy before technical integration NIST SP 800-39 advises that central bodies should establish policies and procedures that coordinate subordinate activities, and a steering committee provides the needed coordination for taxonomy definition.

Acme Corp is adopting a new organization‑wide data‑encryption requirement. As the risk practitioner tasked with establishing the appropriate policy framework, what should be done first?

• A.Create a high‑level program policy that defines the organization’s overall encryption objectives and risk appetite.
• B.Assign ownership and accountability for encryption controls to the IT security manager.
• C.Draft detailed procedures that outline step‑by‑step tasks for system administrators to configure encryption.
• D.Develop a set of technical standards that specify the encryption algorithms and key lengths to be used.

Why: Establish the high‑level program policy before developing standards, procedures, or assigning owners. NIST SP 800-12r1 defines three basic policy types and states that a program‑level policy is created first; standards, guidelines, and procedures are then derived to implement that policy. The first step is therefore a high‑level program policy that sets objectives and risk appetite.

Acme Health, a regional healthcare provider, is revising its risk management program. Senior leadership wants the program to align with the organization’s culture, which emphasizes patient safety and data availability. The risk practitioner is tasked with ensuring the program’s risk tolerance is realistic and supported by the culture. What should the risk practitioner do first to align risk tolerance with organizational culture?

• A.Facilitate workshops with senior leaders and staff to identify shared values that influence risk trade‑offs.
• B.Conduct a formal survey of employees to quantify their personal risk attitudes toward data confidentiality.
• C.Draft a new risk tolerance statement based on industry best‑practice benchmarks and circulate it for approval.
• D.Review the organization’s published risk strategy documents and compare them with observed leadership behaviors.

Why: Identify shared organizational values before defining risk tolerance NIST SP 800-39 explains that senior leaders set risk tolerance through both formal guidance and informal actions, and that understanding existing organizational values and priorities is essential. Facilitating workshops to surface shared values directly addresses this need, ensuring the risk tolerance reflects the culture before any formal statements are created.

What should the risk executive function do first when aligning information‑security risk management with the organization’s strategic goals?

• A.Define the organization’s risk appetite.
• B.Conduct an organization‑wide risk assessment.
• C.Review existing security policies for gaps.
• D.Communicate risk findings to the board of directors.

Why: Establish risk appetite before other risk‑management activities. NIST SP 800-12r1 states that the risk executive ensures risk considerations are viewed organization‑wide and must first define the risk appetite to guide subsequent actions.

During its annual risk review, the organization discovers that many identified risks are assigned to owners who do not have authority over the affected processes. Which action should the risk practitioner prioritize to improve risk ownership alignment?

• A.Map each risk to the business process owner who controls the relevant assets
• B.Deploy an automated risk‑register tool across all units
• C.Revise the organization’s risk appetite to reflect current capabilities
• D.Create a new board‑level risk oversight committee

Why: Align risk owners with the business processes they control Mapping risks to the appropriate business process owners follows NIST SP 800-39 Tier 1 guidance that governance structures must ensure risk responsibilities are tied to the entities that can manage the associated controls.

A multinational corporation’s senior executives have published a risk‑tolerance statement that emphasizes high availability, but employee surveys reveal a culture that prioritizes cost‑saving over uptime. What should the risk practitioner do FIRST to address this misalignment?

• A.Communicate the existing risk‑tolerance statement to staff without further analysis
• B.Conduct a cultural assessment to compare existing values with the stated risk tolerance
• C.Revise the risk‑tolerance statement to match observed employee attitudes
• D.Implement technical controls that force high availability regardless of culture

Why: Identify cultural gaps before changing risk policies NIST SP 800-39 explains that risk tolerance must be consistent with an organization’s values, beliefs and norms; a cultural assessment is the initial step to detect misalignment.

An organization wants risk governance to provide transparency, responsibility, and accountability. Which governance activity best supports this objective?

• A.Delegating all risk decisions to the CFO
• B.Assigning risk owners for each identified risk
• C.Conducting quarterly risk workshops without documenting outcomes
• D.Publishing risk heat maps to all employees

Why: Designate clear risk owners to ensure accountability and transparent oversight NIST SP 800-221 emphasizes that risk governance provides transparency and accountability, which is achieved by assigning owners to each risk

GlobalHealth, a regional healthcare provider, is formalizing its business continuity program. Which governance role should be assigned primary responsibility for maintaining the organization’s Business Continuity Plan?

• A.Business Continuity Manager
• B.Chief Operating Officer
• C.Chief Financial Officer
• D.Chief Information Officer

Why: Assign clear ownership of the BCP to a dedicated continuity role NIST SP 800-221 describes governance as providing accountability; the Business Continuity Manager is the role that centralizes responsibility for the BCP.

A multinational corporation uses a centralized governance structure for its IT risk program. Which benefit most directly ensures consistent implementation of disaster‑recovery testing across all subsidiaries?

• A.Localized decision‑making on recovery priorities
• B.Uniform policies and procedures for DR testing
• C.Separate risk registers for each business unit
• D.Increased autonomy for each subsidiary’s IT team

Why: Centralized governance creates consistent DR testing standards NIST SP 800-39 explains that centralized governance establishes organization‑wide policies and procedures, guaranteeing uniform DR testing across units.

MetroBank experiences a severe ransomware attack that disables its core banking application. According to its disaster‑recovery plan, what is the most appropriate immediate action for the incident response team?

• A.Begin a root‑cause forensic investigation before any other steps
• B.Activate the pre‑defined recovery procedures and alert the Business Continuity Manager
• C.Request additional budget to replace the affected hardware
• D.Notify customers of potential data loss before restoring services

Why: Follow the DR plan to restore operations promptly NIST SP 800-34r1 outlines that the first action in a disruption is to execute the DR plan’s recovery procedures and notify the continuity manager to coordinate restoration.

A multinational corporation wants to improve oversight of its critical hardware and software assets. Which action should the risk practitioner recommend FIRST to align asset management with the organization’s governance model?

• A.Assign asset tracking to the internal audit team
• B.Delegate asset classification to each business unit’s finance manager
• C.Develop separate asset registers for each regional office
• D.Create a centralized asset inventory policy and have senior IT approve it

Why: Establish a centralized policy to ensure consistent asset management across the enterprise NIST SP 800-39 emphasizes that centralized governance bodies establish policies and procedures that provide consistency organization‑wide, which is essential for a uniform asset inventory