CRISC · Question #306
An organization is developing a risk universe to create a holistic view of its overall risk profile. Which of the following is the GREATEST barrier to achieving the initiative's objectives?
The correct answer is B. Lack of common understanding of the organization's risk culture. A lack of common understanding of the organization's risk culture is the greatest barrier to developing a holistic risk universe, as it impedes consistent risk identification and assessment across departments.
Question
An organization is developing a risk universe to create a holistic view of its overall risk profile. Which of the following is the GREATEST barrier to achieving the initiative's objectives?
Options
- ALack of cross-functional risk assessment workshops within the organization
- BLack of common understanding of the organization's risk culture
- CLack of quantitative methods to aggregate the total risk exposure
- DLack of an integrated risk management system to aggregate risk scenarios
How the community answered
(26 responses)- A19% (5)
- B46% (12)
- C8% (2)
- D27% (7)
Why each option
A lack of common understanding of the organization's risk culture is the greatest barrier to developing a holistic risk universe, as it impedes consistent risk identification and assessment across departments.
Lack of cross-functional workshops is a procedural barrier, but a common understanding of risk culture would naturally foster such collaboration or make their outcomes more consistent.
A strong and consistent risk culture ensures that all employees understand and align with the organization's approach to risk, promoting consistent risk identification, reporting, and management across all functions, which is essential for building a truly holistic and accurate risk universe. Without this, different departments may interpret and prioritize risks inconsistently.
While quantitative methods are desirable for aggregation, a risk universe can still be built with qualitative methods; the primary barrier is not the aggregation method itself, but the foundational understanding of what constitutes risk.
An integrated risk management system facilitates aggregation but is a tool; without a common understanding of risk culture, even an advanced system would aggregate inconsistent or misaligned data.
Concept tested: Risk culture and risk universe development
Source: https://www.isaca.org/resources/isaca-journal/issues/2020/volume-5/building-an-enterprise-risk-management-erm-framework
Topics
Community Discussion
No community discussion yet for this question.