CRISC · Question #60
Which of the following should be of MOST concern to a risk practitioner reviewing an organization risk register after the completion of a series of risk assessments?
The correct answer is A. Several risk action plans have missed target completion dates. The most significant concern for a risk practitioner reviewing a risk register is when several risk action plans have missed their target completion dates, indicating a failure in risk mitigation and potentially leaving the organization exposed.
Question
Which of the following should be of MOST concern to a risk practitioner reviewing an organization risk register after the completion of a series of risk assessments?
Options
- ASeveral risk action plans have missed target completion dates.
- BSenior management has accepted more risk than usual.
- CRisk associated with many assets is only expressed in qualitative terms.
- DMany risk scenarios are owned by the same senior manager.
How the community answered
(26 responses)- A77% (20)
- B12% (3)
- C8% (2)
- D4% (1)
Why each option
The most significant concern for a risk practitioner reviewing a risk register is when several risk action plans have missed their target completion dates, indicating a failure in risk mitigation and potentially leaving the organization exposed.
Missed target completion dates for risk action plans signify that identified risks are not being addressed and mitigated in a timely manner. This directly indicates a failure in the risk treatment process, leaving the organization exposed to known vulnerabilities and potential incidents, making it the most immediate and critical concern for a risk practitioner.
Senior management accepting more risk than usual, while potentially concerning, is a management decision and part of risk appetite, not necessarily an immediate failure in the risk management process itself, provided the decision is informed.
While quantitative risk assessment is often preferred, expressing risk in qualitative terms is a valid and common approach, especially when precise data is unavailable, and it doesn't inherently indicate a failure in risk management.
Having many risk scenarios owned by the same senior manager might indicate a potential bottleneck or workload issue, but it does not directly represent a failure to mitigate existing risks as much as missed action plan deadlines.
Concept tested: Risk register monitoring / Risk treatment effectiveness
Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf
Topics
Community Discussion
No community discussion yet for this question.