nerdexam
Isaca

CRISC · Question #60

Which of the following should be of MOST concern to a risk practitioner reviewing an organization risk register after the completion of a series of risk assessments?

The correct answer is A. Several risk action plans have missed target completion dates. The most significant concern for a risk practitioner reviewing a risk register is when several risk action plans have missed their target completion dates, indicating a failure in risk mitigation and potentially leaving the organization exposed.

Submitted by jaden.t· Apr 18, 2026Risk Response and Reporting

Question

Which of the following should be of MOST concern to a risk practitioner reviewing an organization risk register after the completion of a series of risk assessments?

Options

  • ASeveral risk action plans have missed target completion dates.
  • BSenior management has accepted more risk than usual.
  • CRisk associated with many assets is only expressed in qualitative terms.
  • DMany risk scenarios are owned by the same senior manager.

How the community answered

(26 responses)
  • A
    77% (20)
  • B
    12% (3)
  • C
    8% (2)
  • D
    4% (1)

Why each option

The most significant concern for a risk practitioner reviewing a risk register is when several risk action plans have missed their target completion dates, indicating a failure in risk mitigation and potentially leaving the organization exposed.

ASeveral risk action plans have missed target completion dates.Correct

Missed target completion dates for risk action plans signify that identified risks are not being addressed and mitigated in a timely manner. This directly indicates a failure in the risk treatment process, leaving the organization exposed to known vulnerabilities and potential incidents, making it the most immediate and critical concern for a risk practitioner.

BSenior management has accepted more risk than usual.

Senior management accepting more risk than usual, while potentially concerning, is a management decision and part of risk appetite, not necessarily an immediate failure in the risk management process itself, provided the decision is informed.

CRisk associated with many assets is only expressed in qualitative terms.

While quantitative risk assessment is often preferred, expressing risk in qualitative terms is a valid and common approach, especially when precise data is unavailable, and it doesn't inherently indicate a failure in risk management.

DMany risk scenarios are owned by the same senior manager.

Having many risk scenarios owned by the same senior manager might indicate a potential bottleneck or workload issue, but it does not directly represent a failure to mitigate existing risks as much as missed action plan deadlines.

Concept tested: Risk register monitoring / Risk treatment effectiveness

Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf

Topics

#Risk Register Review#Risk Action Plans#Risk Treatment Effectiveness#Risk Monitoring

Community Discussion

No community discussion yet for this question.

Full CRISC Practice