- (Exam Topic 3)
Which of the following would BEST indicate to senior management that IT processes are improving?

1. A. Changes in the number of intrusions detected
2. B. Changes in the number of security exceptions
3. C. Changes in the position in the maturity model
4. D. Changes to the structure of the risk register

Correct Answer: B

- (Exam Topic 3)
Which of the following would be MOST helpful to a risk practitioner when ensuring that mitigated risk remains within acceptable limits?

1. A. Building an organizational risk profile after updating the risk register
2. B. Ensuring risk owners participate in a periodic control testing process
3. C. Designing a process for risk owners to periodically review identified risk
4. D. Implementing a process for ongoing monitoring of control effectiveness

Correct Answer: D

- (Exam Topic 2)
Which of the following is the MOST important reason to revisit a previously accepted risk?

1. A. To update risk ownership
2. B. To review the risk acceptance with new stakeholders
3. C. To ensure risk levels have not changed
4. D. To ensure controls are still operating effectively

Correct Answer: C

- (Exam Topic 2)
Which of the following is the BEST way for a risk practitioner to verify that management has addressed control issues identified during a previous external audit?

1. A. Interview control owners.
2. B. Observe the control enhancements in operation.
3. C. Inspect external audit documentation.
4. D. Review management's detailed action plans.

Correct Answer: B

- (Exam Topic 2)
Which of the following will BEST help ensure that risk factors identified during an information systems review are addressed?

1. A. Informing business process owners of the risk
2. B. Reviewing and updating the risk register
3. C. Assigning action items and deadlines to specific individuals
4. D. Implementing new control technologies

Correct Answer: C