nerdexam
Isaca

CRISC · Question #136

Which of the following is the PRIMARY reason for sharing risk assessment reports with senior stakeholders?

The correct answer is A. To support decision-making for risk response. The primary reason for sharing risk assessment reports with senior stakeholders is to support their decision-making regarding appropriate risk responses. These reports provide the necessary information for strategic choices on how to manage identified risks.

Submitted by akirajp· Apr 18, 2026Risk Response and Reporting

Question

Which of the following is the PRIMARY reason for sharing risk assessment reports with senior stakeholders?

Options

  • ATo support decision-making for risk response
  • BTo hold risk owners accountable for risk action plans
  • CTo secure resourcing for risk treatment efforts
  • DTo enable senior management to compile a risk profile

How the community answered

(56 responses)
  • A
    77% (43)
  • B
    7% (4)
  • C
    13% (7)
  • D
    4% (2)

Why each option

The primary reason for sharing risk assessment reports with senior stakeholders is to support their decision-making regarding appropriate risk responses. These reports provide the necessary information for strategic choices on how to manage identified risks.

ATo support decision-making for risk responseCorrect

Senior stakeholders, particularly senior management and boards, are ultimately responsible for making strategic decisions about how to address identified risks, including accepting, mitigating, transferring, or avoiding them. Risk assessment reports provide the critical information (likelihood, impact, current controls, etc.) they need to make informed and effective risk response decisions that align with organizational objectives and risk appetite.

BTo hold risk owners accountable for risk action plans

While risk owners are accountable, sharing reports is primarily for decision-making by senior leadership, who then direct accountability.

CTo secure resourcing for risk treatment efforts

Securing resourcing for risk treatment is a consequence of decision-making, not the primary reason for presenting the report itself.

DTo enable senior management to compile a risk profile

Senior management primarily receives the risk profile and assessment; compiling it is the role of risk management practitioners.

Concept tested: Risk communication to senior stakeholders

Topics

#Risk Reporting#Decision Making#Senior Management#Risk Response

Community Discussion

No community discussion yet for this question.

Full CRISC Practice