- (Exam Topic 3)
While reviewing an organization's monthly change management metrics, a risk practitioner notes that the number of emergency changes has increased substantially Which of the following would be the BEST approach for the risk practitioner to take?

1. A. Temporarily suspend emergency changes.
2. B. Document the control deficiency in the risk register.
3. C. Conduct a root cause analysis.
4. D. Continue monitoring change management metrics.

Correct Answer: C

- (Exam Topic 3)
A business unit is implementing a data analytics platform to enhance its customer relationship management (CRM) system primarily to process data that has been provided by its customers. Which of the following presents the GREATEST risk to the organization's reputation?

1. A. Third-party software is used for data analytics.
2. B. Data usage exceeds individual consent.
3. C. Revenue generated is not disclosed to customers.
4. D. Use of a data analytics system is not disclosed to customers.

Correct Answer: B

- (Exam Topic 3)
A maturity model is MOST useful to an organization when it:

1. A. benchmarks against other organizations
2. B. defines a qualitative measure of risk
3. C. provides a reference for progress
4. D. provides risk metrics.

Correct Answer: C

- (Exam Topic 2)
An organization has recently updated its disaster recovery plan (DRP). Which of the following would be the GREATEST risk if the new plan is not tested?

1. A. External resources may need to be involved.
2. B. Data privacy regulations may be violated.
3. C. Recovery costs may increase significantly.
4. D. Service interruptions may be longer than anticipated.

Correct Answer: D

- (Exam Topic 3)
To reduce costs, an organization is combining the second and third tines of defense in a new department that reports to a recently appointed C-level executive. Which of the following is the GREATEST concern with this situation?

1. A. The risk governance approach of the second and third lines of defense may differ.
2. B. The independence of the internal third line of defense may be compromised.
3. C. Cost reductions may negatively impact the productivity of other departments.
4. D. The new structure is not aligned to the organization's internal control framework.

Correct Answer: B