CRISC Exam Questions and Answers | Exam-Dumps (Page: 37)

QUESTION: 181

Which of the following individuals is responsible for identifying process requirements, approving process design and managing process performance?

Business process owner
Risk owner
Chief financial officer
Chief information officer

Answer(s): A

Explanation:

Business process owners are the individuals responsible for identifying process requirements, approving process design and managing process performance. In general, a business process owner must be at an appropriately high level in the enterprise and have authority to commit resources to process-specific risk management activities.

Incorrect Answers:
B: Risk owner for each risk should be the person who has the most influence over its outcome. Selecting the risk owner thus usually involves considering the source of risk and identifying the person who is best placed to understand and implement what needs to be done.

C: Chief financial officer is the most senior official of the enterprise who is accountable for financial planning, record keeping, investor relations and financial risks.

D: Chief information officer is the most senior official of the enterprise who is accountable for IT advocacy; aligning IT and business strategies; and planning, resourcing and managing the delivery of IT services and information and the deployment of associated human resources.

Reveal Solution Next Question

QUESTION: 182

Which of the following should be considered to ensure that risk responses that are adopted are cost-effective and are aligned with business objectives?
Each correct answer represents a part of the solution. Choose three.

Identify the risk in business terms
Recognize the business risk appetite
Adopt only pre-defined risk responses of business
Follow an integrated approach in business

Answer(s): A,B,D

Explanation:

Risk responses require a formal approach to issues, opportunities and events to ensure that solutions are cost- effective and are aligned with business objectives. The following should be considered:
While preparing the risk response, identify the risk in business terms like loss of productivity, disclosure of confidential information, lost opportunity costs, etc.
Recognize the business risk appetite. Follow an integrated approach in business.

Risk responses requiring an investment should be supported by a carefully planned business case that justifies the expenditure outlines alternatives and describes the justification for the alternative selected.

Incorrect Answers:
C: There is no such requirement to follow the pre-defined risk responses. If some new risk responses are discovered during the risk management of a particular project, they should be noted down in lesson leaned document so that project manager working on some other project could also utilize them.

Reveal Solution Next Question

QUESTION: 183

Walter is the project manager of a large construction project. He'll be working with several vendors on the project. Vendors will be providing materials and labor for several parts of the project. Some of the works in the project are very dangerous so Walter has implemented safety requirements for all of the vendors and his own project team. Stakeholders for the project have added new requirements, which have caused new risks in the project. A vendor has identified a new risk that could affect the project if it comes into fruition. Walter agrees with the vendor and has updated the risk register and created potential risk responses to mitigate the risk. What should Walter also update in this scenario considering the risk event?

Project management plan
Project communications plan
Project contractual relationship with the vendor
Project scope statement

Answer(s): A

Explanation:

When new risks are identified as part of the scope additions, Walter should update the risk register and the project management plan to reflect the responses to the risk event.

Incorrect Answers:
B: The project communications management plan may be updated if there's a communication need but the related to the risk event, not the communication of the risks.

C: The contractual relationship won't change with the vendor as far as project risks are concerned. D: The project scope statement is changed as part of the scope approval that has already happened.

Reveal Solution Next Question

QUESTION: 184

What are the three PRIMARY steps to be taken to initialize the project? Each correct answer represents a complete solution. (Choose three.)

Conduct a feasibility study
Define requirements
Acquire software
Plan risk management

Answer(s): A,B,C

Explanation:

Projects are initiated by sponsors who gather the information required to gain approval for the project to be created. Information often compiled into the terms of a project charter includes the objective of the project, business case and problem statement, stakeholders in the system to be produced, and project manager and sponsor.

Following are the steps to initiate the project:
Conduct a feasibility study: Feasibility study starts once initial approval has been given to move forward with a project, and includes an analysis to clearly define the need and to identify alternatives for addressing the need. A feasibility study involves:
- Analyzing the benefits and solutions for the identified problem area
- Development of a business case that states the strategic benefits of implementing the system either in productivity gains or in future cost avoidance and identifies and quantifies the cost savings of the new system.
- Estimation of a payback schedule for the cost incurred in implementing the system or shows the projected return on investment (ROI)
Define requirements: Requirements include:
- Business requirements containing descriptions of what a system should do
- Functional requirements and use case models describing how users will interact with a system
- Technical requirements and design specifications and coding specifications describing how the system will interact, conditions under which the system will operate and the information criteria the system should meet.
Acquire software: Acquiring software involves building new or modifying existing hardware or software after final approval by the stakeholder, which is not a phase in the standard SDLC process. If a decision was reached to acquire rather than develop software, this task should occur after defining requirements.

Incorrect Answers:
D: Risk management is planned latter in project development process, and not during initialization.

Reveal Solution Next Question

QUESTION: 185

You are the risk official in Techmart Inc. You are asked to perform risk assessment on the impact of losing a network connectivity for 1 day. Which of the following factors would you include?

Aggregate compensation of all affected business users.
Hourly billing rate charged by the carrier
Value that enterprise get on transferring data over the network
Financial losses incurred by affected business units

Answer(s): D

Explanation:

The impact of network unavailability is the cost it incurs to the enterprise. As the network is unavailable for 1 day, it can be considered as the failure of some business units that rely on this network. Hence financial losses incurred by this affected business unit should be considered.

Incorrect Answers:
A, B, C: These factors in combination contribute to the overall financial impact, i.e., financial losses incurred by affected business units.

Reveal Solution Next Question

ISACA CRISC Exam (page: 37) ISACA Certified in Risk and Information Systems Control Updated on: 25-Dec-2025

QUESTION: 181

Explanation:

QUESTION: 182

Explanation:

QUESTION: 183

Explanation:

QUESTION: 184

Explanation:

QUESTION: 185

Explanation:

ISACA CRISC Exam (page: 37)
ISACA Certified in Risk and Information Systems Control
Updated on: 25-Dec-2025