nerdexam
Isaca

CRISC · Question #6

An organization maintains independent departmental risk registers that are not automatically aggregated. Which of the following is the GREATEST concern?

The correct answer is A. Management may be unable to accurately evaluate the risk profile.. The greatest concern with unaggregated departmental risk registers is that management cannot accurately evaluate the organization's overall risk profile, leading to incomplete or misleading strategic decisions.

Submitted by omar99· Apr 18, 2026Governance

Question

An organization maintains independent departmental risk registers that are not automatically aggregated. Which of the following is the GREATEST concern?

Options

  • AManagement may be unable to accurately evaluate the risk profile.
  • BResources may be inefficiently allocated.
  • CThe same risk factor may be identified in multiple areas.
  • DMultiple risk treatment efforts may be initiated to treat a given risk.

How the community answered

(43 responses)
  • A
    44% (19)
  • B
    30% (13)
  • C
    19% (8)
  • D
    7% (3)

Why each option

The greatest concern with unaggregated departmental risk registers is that management cannot accurately evaluate the organization's overall risk profile, leading to incomplete or misleading strategic decisions.

AManagement may be unable to accurately evaluate the risk profile.Correct

Without aggregation, senior management lacks a consolidated, holistic view of risks across the entire organization, preventing an accurate evaluation of the overall enterprise risk profile, effective prioritization, and informed strategic decision-making regarding risk management.

BResources may be inefficiently allocated.

While inefficient resource allocation can result from fragmented risk information, the inability to accurately assess the overarching risk profile is a more fundamental governance issue that underpins such operational inefficiencies.

CThe same risk factor may be identified in multiple areas.

Identifying the same risk factor in multiple areas is a symptom of unaggregated data, but the core problem is management's resulting inability to see and address this duplication effectively.

DMultiple risk treatment efforts may be initiated to treat a given risk.

Initiating multiple risk treatment efforts for the same risk is a consequence of lacking a unified view, but the greatest concern is the higher-level inability of management to form an accurate, enterprise-wide risk picture.

Concept tested: Enterprise Risk Management (ERM) aggregation

Topics

#Risk Aggregation#Enterprise Risk Management#Risk Reporting#Management Oversight

Community Discussion

No community discussion yet for this question.

Full CRISC Practice