CRISC · Question #326
Reviewing which of the following BEST helps an organization gain insight into its overall risk profile?
The correct answer is C. Risk register. The risk register is the central repository for identified risks, their assessment, and treatment plans, offering the most comprehensive view of an organization's overall risk profile.
Question
Reviewing which of the following BEST helps an organization gain insight into its overall risk profile?
Options
- AThreat landscape
- BRisk appetite
- CRisk register
- DRisk metrics
How the community answered
(28 responses)- A4% (1)
- C93% (26)
- D4% (1)
Why each option
The risk register is the central repository for identified risks, their assessment, and treatment plans, offering the most comprehensive view of an organization's overall risk profile.
The threat landscape identifies potential external dangers but doesn't detail how these threats specifically impact the organization or its current risk posture.
Risk appetite defines the amount of risk an organization is willing to accept, which is a policy statement, not a dynamic list of actual risks.
A risk register systematically documents all identified risks, their likelihood, impact, current controls, and planned responses. Reviewing the risk register provides a holistic, consolidated view of an organization's specific risks and their current status, thereby giving the best insight into its overall risk profile.
Risk metrics provide specific measurements of risk elements or control effectiveness but offer a fragmented view compared to the comprehensive overview of the risk register.
Concept tested: Risk register for risk profile insight
Source: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-30r1.pdf
Topics
Community Discussion
No community discussion yet for this question.