CRISC · Question #163
After entering a large number of low-risk scenarios into the risk register, it is MOST important for the risk practitioner to:
The correct answer is D. analyze changes to aggregate risk. After identifying numerous low-risk scenarios, it is most important for a risk practitioner to analyze how these individual risks contribute to the overall aggregate risk of the organization. Even small, seemingly insignificant risks can collectively become a significant threat…
Question
After entering a large number of low-risk scenarios into the risk register, it is MOST important for the risk practitioner to:
Options
- Aprepare a follow-up risk assessment.
- Brecommend acceptance of the risk scenarios.
- Creconfirm risk tolerance levels.
- Danalyze changes to aggregate risk.
How the community answered
(43 responses)- A5% (2)
- B7% (3)
- C16% (7)
- D72% (31)
Why each option
After identifying numerous low-risk scenarios, it is most important for a risk practitioner to analyze how these individual risks contribute to the overall aggregate risk of the organization. Even small, seemingly insignificant risks can collectively become a significant threat when combined.
Preparing a follow-up risk assessment might be part of a broader risk management cycle, but the immediate and most important step after adding many risks is to understand their collective impact.
Recommending acceptance of low-risk scenarios without first assessing their aggregate impact could lead to an unknowingly high overall risk exposure.
Reconfirming risk tolerance levels is an important governance activity, but it's done periodically or when the business context changes significantly, not necessarily as the immediate next step after entering new risks into the register, especially before understanding their impact.
Even low-risk scenarios, when numerous, can combine to create a significant aggregate risk that exceeds the organization's risk appetite. Analyzing changes to aggregate risk allows the practitioner to understand the cumulative impact of these individual low-level risks and determine if additional controls or treatments are needed to maintain overall risk within acceptable levels.
Concept tested: Aggregate risk management
Source: https://learn.microsoft.com/en-us/compliance/risk/manage-aggregate-risk
Topics
Community Discussion
No community discussion yet for this question.