Free Access ISACA.CRISC.v2022-05-05.q821 Practice Test (Page 108)

Question 531

You are the project manager of your enterprise. You have identified several risks. Which of the following responses to risk is considered the MOST appropriate?

A.Any of the above

B.Insuring

C.Avoiding

D.Accepting

E.Explanation:
The appropriate response to the risk is decided by the risk itself, the company's attitude and
appetite of risk, and the threat and opportunity combination of the risk.

Question 532

According to the Section-302 of the Sarbanes-Oxley Act of 2002, what does certification of reports implies?
Each correct answer represents a complete solution. Choose three.

A.The signing officer has evaluated the effectiveness of the issuer's internal controls as of a date at the time to report.

B.The financial statement does not contain any materially untrue or misleading information.

C.The signing officer has reviewed the report.

D.The signing officer has presented in the report their conclusions about the effectiveness of their internal controls based on their evaluation as of that date.

Correct Answer: B,C,D

Explanation/Reference:
Explanation:
Section 302 of Sarbanes-Oxley act has the tremendous impact on the risk management solution adopted by corporations. This section specifies that the reports must be certified by the CEO, CFO, or other senior officer performing similar functions.
Certification of reports establishes:
The signing officer has reviewed the report.

The financial statement do not contain, to the knowledge of signing officer, any materially untrue or

misleading information and represent fairly all financial conditions and results of the enterprise's operations.
The signing officers:

- are responsible for establishing and maintaining internal controls
- have designed such internal controls to ensure that material information relating to the issuer and its consolidated subsidiaries is made - known to such officers by others within those entities, particularly during the period in which the periodic reports are being prepared
- have evaluated the effectiveness of the issuer's internal controls as of a date within 90 days prior to the report
- have presented in the report their conclusions about the effectiveness of their internal controls base on their evaluation as of that date The signing officer have disclosed to external auditors, audit committee, and other directors:

- all significant deficiencies in the design or operation of internal controls which could adversely affect the reliability of the reported financial data
- any fraud, whether or not material, that involves management or other employees who have a significant role in the internal controls of the enterprise The signing officer have indicated in the report any internal controls or changes to those internal

controls which have been implemented since they were evaluated.
Incorrect Answers:
A: The signing officer has evaluated the effectiveness of the issuer's internal controls as of a date within 90 days prior to the report, not at the time of the report.

Question 533

A risk practitioner is developing a set of bottom-up IT risk scenarios. The MOST important time to involve business stakeholders is when:

A.updating the risk register

B.validating the risk scenarios

C.documenting the risk scenarios.

D.identifying risk mitigation controls.

Question 534

You are the project manager of a large construction project. This project will last for 18 months and will cost $750,000 to complete. You are working with your project team, experts, and stakeholders to identify risks within the project before the project work begins. Management wants to know why you have scheduled so many risk identification meetings throughout the project rather than just initially during the project planning. What is the best reason for the duplicate risk identification sessions?

A.The iterative meetings allow all stakeholders to participate in the risk identification processes throughout the project phases.

B.The iterative meetings allow the project manager to discuss the risk events which have passed the project and which did not happen.

C.The iterative meetings allow the project manager and the risk identification participants to identify newly discovered risk events throughout the project.

D.The iterative meetings allow the project manager to communicate pending risks events during project execution.

E.Explanation:
Risk identification is an iterative process because new risks may evolve or become known as the project progresses through its life cycle.

Question 535

Which of the following is the MOST important consideration when developing an organization's risk taxonomy?

A.Business context

B.Leading industry frameworks

C.Regulatory requirements

D.IT strategy

Other Version: 3507ISACA.CRISC.v2025-07-19.q999; 6572ISACA.CRISC.v2024-09-11.q999; 7512ISACA.CRISC.v2022-10-10.q527; 12586ISACA.CRISC.v2022-08-23.q834; 66ISACA.Examboosts.CRISC.v2021-09-26.by.erica.460q.pdf

Latest Upload: 108Oracle.1z0-1196-25.v2025-09-12.q18; 109NetworkAppliance.NS0-162.v2025-09-12.q86; 149OCEG.GRCP.v2025-09-11.q211; 109HP.HPE0-V27.v2025-09-11.q78; 125Oracle.1Z0-1057-23.v2025-09-10.q47; 159Google.Professional-Cloud-Network-Engineer.v2025-09-09.q179; 139SAP.C-S4EWM-2023.v2025-09-08.q83; 183TheSecOpsGroup.CNSP.v2025-09-08.q20; 267CFAInstitute.ESG-Investing.v2025-09-08.q173; 257PECB.ISO-IEC-27001-Lead-Implementer.v2025-09-06.q132

Question 531

Question 532

Question 533

Question 534

Question 535

Download PDF File