nerdexam
Isaca

CRISC · Question #318

Which of the following is the BEST recommendation of a risk practitioner for an organization that recently changed its organizational structure?

The correct answer is A. Communicate the new risk profile. After an organizational structure change, the risk practitioner's best recommendation is to communicate the new risk profile to ensure all stakeholders understand the updated risk landscape.

Submitted by rachelw· Apr 18, 2026Risk Response and Reporting

Question

Which of the following is the BEST recommendation of a risk practitioner for an organization that recently changed its organizational structure?

Options

  • ACommunicate the new risk profile.
  • BImplement a new risk assessment process.
  • CRevalidate the corporate risk appetite.
  • DReview and adjust key risk indicators (KRIs).

How the community answered

(30 responses)
  • A
    70% (21)
  • B
    17% (5)
  • C
    3% (1)
  • D
    10% (3)

Why each option

After an organizational structure change, the risk practitioner's best recommendation is to communicate the new risk profile to ensure all stakeholders understand the updated risk landscape.

ACommunicate the new risk profile.Correct

An organizational structure change can significantly alter responsibilities, reporting lines, processes, and even strategic objectives, thereby shifting the organization's overall risk profile; communicating this new profile ensures all stakeholders, especially leadership, are aware of the updated risk landscape and can make informed decisions.

BImplement a new risk assessment process.

Implementing an entirely new risk assessment process might be excessive; existing processes might only need to be re-run or adjusted to reflect the new structure rather than being completely replaced.

CRevalidate the corporate risk appetite.

While a structural change might prompt a revalidation of risk appetite, the direct and immediate consequence for the practitioner is to understand and communicate the *current* change in risk, with revalidating appetite being a higher-level strategic decision that might follow.

DReview and adjust key risk indicators (KRIs).

Reviewing and adjusting key risk indicators (KRIs) is a valuable step, but it is an action taken *after* understanding the new risk profile to monitor it effectively, rather than the initial, overarching recommendation.

Concept tested: Impact of Organizational Change on Risk

Source: https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/govern/security-baseline/security-baseline-risk-management

Topics

#Risk communication#Organizational change impact#Risk profile management#Stakeholder awareness

Community Discussion

No community discussion yet for this question.

Full CRISC Practice