CISA IT Risk Management 2 — Questions and Answers
Question 1: Which risk treatment option involves transferring the financial consequences of a risk to a third party?
- Risk avoidance
- Risk mitigation
- Risk transfer (Correct answer)
- Risk acceptance
Correct answer: Risk transfer
Risk transfer shifts the financial burden of a risk to another party, such as through insurance or outsourcing contracts.
Question 2: A CISA auditor finds that a company's risk register has not been updated in 18 months. What is the PRIMARY concern?
- The risk register format may be outdated
- Emerging risks may not be identified or monitored (Correct answer)
- The audit trail is incomplete
- Risk owners have not been assigned
Correct answer: Emerging risks may not be identified or monitored
A stale risk register means new and evolving threats may go unrecognized, leaving the organization exposed to unmanaged risks.
Question 3: In IT risk management, what does 'residual risk' refer to?
- Risk that has been fully eliminated
- Risk remaining after controls are applied (Correct answer)
- Risk transferred to a third party
- Risk identified but not yet assessed
Correct answer: Risk remaining after controls are applied
Residual risk is the level of risk that remains after control measures have been implemented.
Question 4: Which of the following BEST describes the purpose of a risk appetite statement?
- To list all identified risks in the organization
- To define the level of risk the organization is willing to accept (Correct answer)
- To assign risk owners to each identified risk
- To document risk mitigation strategies
Correct answer: To define the level of risk the organization is willing to accept
A risk appetite statement articulates how much risk the board and senior management are willing to tolerate in pursuit of business objectives.
Question 5: An organization uses Key Risk Indicators (KRIs). What is the PRIMARY purpose of KRIs?
- To measure the effectiveness of IT controls after an incident
- To provide early warning signals of increasing risk exposure (Correct answer)
- To document risk scenarios for audit purposes
- To replace the need for a formal risk assessment
Correct answer: To provide early warning signals of increasing risk exposure
KRIs act as leading indicators that signal when risk levels are approaching thresholds, enabling proactive management.
Question 6: Which risk assessment approach assigns numerical values to the likelihood and impact of risks to calculate an overall risk score?
- Qualitative risk assessment
- Quantitative risk assessment (Correct answer)
- Delphi technique
- Control self-assessment
Correct answer: Quantitative risk assessment
Quantitative risk assessment uses numerical values and formulas (e.g., ALE = ARO × SLE) to express risk in financial or statistical terms.
Question 7: When performing an IT risk assessment, what does 'threat likelihood' measure?
- The potential damage a threat could cause if it occurs
- The probability that a threat will exploit a vulnerability (Correct answer)
- The cost of implementing a control to prevent the threat
- The number of assets exposed to the threat
Correct answer: The probability that a threat will exploit a vulnerability
Threat likelihood estimates how probable it is that a given threat will actually materialize and exploit an existing vulnerability.
CISA IT Risk Management 2
Which risk treatment option involves transferring the financial consequences of a risk to a third party?