CRISC · Question #6
An organization maintains independent departmental risk registers that are not automatically aggregated. Which of the following is the GREATEST concern?
The correct answer is A. Management may be unable to accurately evaluate the risk profile.. The greatest concern with unaggregated departmental risk registers is that management cannot accurately evaluate the organization's overall risk profile, leading to incomplete or misleading strategic decisions.
Question
An organization maintains independent departmental risk registers that are not automatically aggregated. Which of the following is the GREATEST concern?
Options
- AManagement may be unable to accurately evaluate the risk profile.
- BResources may be inefficiently allocated.
- CThe same risk factor may be identified in multiple areas.
- DMultiple risk treatment efforts may be initiated to treat a given risk.
How the community answered
(43 responses)- A44% (19)
- B30% (13)
- C19% (8)
- D7% (3)
Why each option
The greatest concern with unaggregated departmental risk registers is that management cannot accurately evaluate the organization's overall risk profile, leading to incomplete or misleading strategic decisions.
Without aggregation, senior management lacks a consolidated, holistic view of risks across the entire organization, preventing an accurate evaluation of the overall enterprise risk profile, effective prioritization, and informed strategic decision-making regarding risk management.
While inefficient resource allocation can result from fragmented risk information, the inability to accurately assess the overarching risk profile is a more fundamental governance issue that underpins such operational inefficiencies.
Identifying the same risk factor in multiple areas is a symptom of unaggregated data, but the core problem is management's resulting inability to see and address this duplication effectively.
Initiating multiple risk treatment efforts for the same risk is a consequence of lacking a unified view, but the greatest concern is the higher-level inability of management to form an accurate, enterprise-wide risk picture.
Concept tested: Enterprise Risk Management (ERM) aggregation
Topics
Community Discussion
No community discussion yet for this question.