nerdexam
Isaca

CRISC · Question #306

An organization is developing a risk universe to create a holistic view of its overall risk profile. Which of the following is the GREATEST barrier to achieving the initiative's objectives?

The correct answer is B. Lack of common understanding of the organization's risk culture. A lack of common understanding of the organization's risk culture is the greatest barrier to developing a holistic risk universe, as it impedes consistent risk identification and assessment across departments.

Submitted by ahmad_uae· Apr 18, 2026Governance

Question

An organization is developing a risk universe to create a holistic view of its overall risk profile. Which of the following is the GREATEST barrier to achieving the initiative's objectives?

Options

  • ALack of cross-functional risk assessment workshops within the organization
  • BLack of common understanding of the organization's risk culture
  • CLack of quantitative methods to aggregate the total risk exposure
  • DLack of an integrated risk management system to aggregate risk scenarios

How the community answered

(26 responses)
  • A
    19% (5)
  • B
    46% (12)
  • C
    8% (2)
  • D
    27% (7)

Why each option

A lack of common understanding of the organization's risk culture is the greatest barrier to developing a holistic risk universe, as it impedes consistent risk identification and assessment across departments.

ALack of cross-functional risk assessment workshops within the organization

Lack of cross-functional workshops is a procedural barrier, but a common understanding of risk culture would naturally foster such collaboration or make their outcomes more consistent.

BLack of common understanding of the organization's risk cultureCorrect

A strong and consistent risk culture ensures that all employees understand and align with the organization's approach to risk, promoting consistent risk identification, reporting, and management across all functions, which is essential for building a truly holistic and accurate risk universe. Without this, different departments may interpret and prioritize risks inconsistently.

CLack of quantitative methods to aggregate the total risk exposure

While quantitative methods are desirable for aggregation, a risk universe can still be built with qualitative methods; the primary barrier is not the aggregation method itself, but the foundational understanding of what constitutes risk.

DLack of an integrated risk management system to aggregate risk scenarios

An integrated risk management system facilitates aggregation but is a tool; without a common understanding of risk culture, even an advanced system would aggregate inconsistent or misaligned data.

Concept tested: Risk culture and risk universe development

Source: https://www.isaca.org/resources/isaca-journal/issues/2020/volume-5/building-an-enterprise-risk-management-erm-framework

Topics

#Risk Culture#Enterprise Risk Management#Risk Governance#Holistic Risk View

Community Discussion

No community discussion yet for this question.

Full CRISC Practice