CRISC · Question #606
Which of the following is the PRIMARY reason to conduct risk assessments at periodic intervals?
The correct answer is A. To ensure emerging risk is identified and monitored. Periodic risk assessments are primarily conducted to identify and monitor new or changing risks that may emerge over time, ensuring the risk register remains current and effective.
Question
Which of the following is the PRIMARY reason to conduct risk assessments at periodic intervals?
Options
- ATo ensure emerging risk is identified and monitored
- BTo establish the maturity level of risk assessment processes
- CTo promote a risk-aware culture among staff
- DTo ensure risk trend data is collected and reported
How the community answered
(58 responses)- A93% (54)
- B2% (1)
- C2% (1)
- D3% (2)
Why each option
Periodic risk assessments are primarily conducted to identify and monitor new or changing risks that may emerge over time, ensuring the risk register remains current and effective.
Risk environments are dynamic, with new threats, vulnerabilities, and business changes constantly emerging. Conducting risk assessments at periodic intervals is essential to identify these emerging risks and changes to existing risks, allowing the organization to proactively adapt its risk management strategies and controls.
Establishing the maturity level of risk assessment processes is a benefit of review and improvement, not the primary reason for conducting the assessments themselves.
Promoting a risk-aware culture is a positive byproduct of risk management activities, but not the primary driver for scheduled risk assessments.
Ensuring risk trend data is collected and reported is part of ongoing risk monitoring, but the periodic assessment itself is for discovering new risks, not just tracking existing ones.
Concept tested: Purpose of periodic risk assessment
Topics
Community Discussion
No community discussion yet for this question.