CRISC · Question #181
Which of the following would be of MOST concern to a risk practitioner reviewing risk action plans for documented IT risk scenarios?
The correct answer is D. Many action plans were discontinued after senior management accepted the risk. The most significant concern for a risk practitioner is the discontinuation of action plans after risk acceptance, as this suggests a failure to manage residual risk effectively.
Question
Which of the following would be of MOST concern to a risk practitioner reviewing risk action plans for documented IT risk scenarios?
Options
- AIndividuals outside IT are managing action plans for the risk scenarios.
- BTarget dates for completion are missing from some action plans.
- CSenior management approved multiple changes to several action plans.
- DMany action plans were discontinued after senior management accepted the risk.
How the community answered
(45 responses)- A9% (4)
- B27% (12)
- C18% (8)
- D47% (21)
Why each option
The most significant concern for a risk practitioner is the discontinuation of action plans after risk acceptance, as this suggests a failure to manage residual risk effectively.
Having individuals outside IT manage action plans can be acceptable and even desirable, especially if they are business process owners, as long as proper oversight and collaboration with IT exist.
Missing target dates are an administrative and tracking issue that needs correction, but it does not fundamentally negate the risk response plan itself or the intent to manage the risk.
Senior management approving changes to action plans indicates governance and engagement, which is typically a positive aspect unless the changes introduce unacceptable risk levels without justification.
Discontinuing action plans after senior management accepts a risk is a major concern because it implies that no further mitigation or monitoring efforts are planned, leaving potential residual risks unaddressed and unmanaged, which could lead to adverse consequences.
Concept tested: Risk management lifecycle; Risk acceptance implications
Topics
Community Discussion
No community discussion yet for this question.