nerdexam
(ISC)2

CGRC · Question #678

You and your project team are identifying the risks that may exist within your project. Some of the risks are small risks that won't affect your project much if they happen. What should you do with…

The correct answer is B. These risks can be added to a low priority risk watch list. When project risks are identified as small and unlikely to significantly impact the project, the appropriate action is to add them to a low priority risk watch list for ongoing monitoring. This approach tracks minor risks without requiring immediate, extensive response planning.

Security and Privacy Governance, Risk Management, and Compliance Program

Question

You and your project team are identifying the risks that may exist within your project. Some of the risks are small risks that won't affect your project much if they happen. What should you do with these identified risk events? Response:

Options

  • AThese risks can be accepted
  • BThese risks can be added to a low priority risk watch list
  • CAll risks must have a valid, documented risk response
  • DThese risks can be dismissed

How the community answered

(30 responses)
  • A
    7% (2)
  • B
    73% (22)
  • C
    17% (5)
  • D
    3% (1)

Why each option

When project risks are identified as small and unlikely to significantly impact the project, the appropriate action is to add them to a low priority risk watch list for ongoing monitoring. This approach tracks minor risks without requiring immediate, extensive response planning.

AThese risks can be accepted

While accepting risk is a valid strategy, simply accepting and forgetting about small risks without any form of tracking could lead to an accumulation of minor issues that eventually become significant.

BThese risks can be added to a low priority risk watch listCorrect

For identified risks that have a low probability of occurring or would have a minimal impact if they do occur, the most practical approach is to add them to a low priority risk watch list or risk register. This allows the project team to monitor these risks periodically, ensuring that they are not forgotten and their status can be re-evaluated if conditions change, without dedicating excessive resources to detailed response planning.

CAll risks must have a valid, documented risk response

Requiring a detailed, documented risk response for every single minor risk event would be overly burdensome and resource-intensive for a project.

DThese risks can be dismissed

Dismissing risks outright means losing all visibility and control over them, which can be problematic if their likelihood or impact increases over time.

Concept tested: Project risk management- low priority risks

Topics

#Risk Management#Risk Identification#Risk Response#Risk Monitoring

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CGRC Practice