Risk Management and IT Governance Quiz

<p>Lisa Young (A)</p> Signup and view all the answers

<p>ISACA Board Chair (D)</p> Signup and view all the answers

<p>The relationship between residual and inherent risk. (C)</p> Signup and view all the answers

<p>Figure 5.2 (C)</p> Signup and view all the answers

<p>The process for risk prioritization and selection. (D)</p> Signup and view all the answers

<p>Different states of risk within an organization. (B)</p> Signup and view all the answers

<p>Figure 5.7 (D)</p> Signup and view all the answers

<p>Addressing the risk with the highest likelihood and impact (C)</p> Signup and view all the answers

<p>Risks arising from the use and dependence on IT systems within an enterprise (D)</p> Signup and view all the answers

<p>Potential for more damaging risks to affect the enterprise (B)</p> Signup and view all the answers

<p>I&amp;T program and project delivery risk (B)</p> Signup and view all the answers

<p>Higher dependence leads to more serious consequences from failures (B)</p> Signup and view all the answers

<p>To exploit control deficiencies (C)</p> Signup and view all the answers

<p>The likelihood of experiencing loss or gain due to uncertain events (D)</p> Signup and view all the answers

<p>Strategic risk (A)</p> Signup and view all the answers

<p>Financial risk (C)</p> Signup and view all the answers

<p>Reduced opportunities for innovation (C)</p> Signup and view all the answers

<p>An outdated technology infrastructure (B)</p> Signup and view all the answers

<p>Higher chances of financial disaster (A)</p> Signup and view all the answers

<p>Risk arising from the internal processes of the business (D)</p> Signup and view all the answers

<p>Program Level (D)</p> Signup and view all the answers

<p>Making choices about risk in connection to innovation (C)</p> Signup and view all the answers

<p>Operational Level (B)</p> Signup and view all the answers

<p>A strategic-level risk policy (C)</p> Signup and view all the answers

<p>Strategic level emphasizes long-term decisions, operational level addresses short-term issues. (A)</p> Signup and view all the answers

<p>Detecting, identifying and managing risk effectively (D)</p> Signup and view all the answers

<p>Project Level (B)</p> Signup and view all the answers

<p>Navigating circumstances that may impact program success (B)</p> Signup and view all the answers

<p>NIST SP 800-37 Revision 2 (D)</p> Signup and view all the answers

<p>CMMI Framework (B)</p> Signup and view all the answers

<p>General risk management guidelines (B)</p> Signup and view all the answers

<p>Information security assessments (B)</p> Signup and view all the answers

<p>ISACA (B)</p> Signup and view all the answers

<p>Information security risk (B)</p> Signup and view all the answers

<p>To align with specific enterprise goals (D)</p> Signup and view all the answers

<p>ISO/IEC 27005:2018 (A)</p> Signup and view all the answers

The process of identifying strategies for managing risk. It involves analyzing the potential impacts of risks and developing plans to accept, mitigate, transfer, or avoid them.

A framework that helps assess the levels of risk acceptance based on the impact and likelihood of the risk. It can involve risk tolerance, risk appetite, and organizational factors.

A tool used to map and visualize the relationship between risk controls and specific risks. It helps organize and analyze control effectiveness and identify gaps in risk management.

The remaining risk after all control measures have been implemented. It's the level of risk that remains despite efforts to mitigate or eliminate it.

The process of selecting and prioritizing risk responses based on the nature, severity, and likelihood of risks. It involves evaluating different options and choosing the most appropriate ones.

ISACA is a global association that focuses on IT governance, risk management, and cybersecurity, often offering certifications for professionals in related fields.

CISA, CRISC, CISM, CGEIT, and CISSP are certifications offered by ISACA for different IT governance and security roles.

The board of directors of ISACA is made up of individuals from different countries and backgrounds, representing diverse expertise in IT governance and security.

The board of directors plays a vital role in guiding the strategic direction of ISACA.

ISACA offers various publications, such as the IT Risk Fundamentals Study Guide, to aid professionals in their learning and development.

A weakness in a system's design, implementation, operation, or internal controls that could expose it to threats.

A potential event that could negatively impact an organization's goals.

The chance that an uncertain event with potential for both loss and gain could prevent an organization from achieving its objectives.

Risk related to an organization's long-term plans and strategies, including expansion, market entry, and infrastructure upgrades.

Risk related to changes in the external environment, such as regulations, climate change, or economic conditions.

Risk related to fluctuations in markets, such as commodity prices, interest rates, or exchange rates.

Risk related to the possibility of customers or partners failing to fulfill their financial obligations.

Risk related to an organization's daily operations, such as fraud, errors, or disruptions in service.

IT-related risk is a part of overall business risk and is associated with the use, ownership, operation, involvement, influence, and adoption of Information Technology (IT) within an organization.

The potential consequences of an IT-related failure increase as an organization relies more heavily on its IT systems for its core operations.

The types of IT-related risks include: IT benefit/value enablement risk, IT program and project delivery risk, IT operations and service delivery risk, and cyber and information security risk.

I&T-related risk management involves responding to the potential impact on the business, identifying the issues, and making sure that the risks with the highest likelihood and impact of occurring are being addressed.

Even if no immediate action is taken, understanding and analyzing IT-related risks is crucial because it can influence strategic decisions and improve an organization's overall risk posture.

The highest level of risk management, where decisions are made regarding overall business strategy and accepting risk as an essential part of innovation and growth.

The level of risk management focused on delivering the strategic plan through projects and programs. This involves making choices about risks that affect these initiatives and managing consequences.

The lowest level of risk management concentrating on day-to-day business operations and ensuring service continuity. This level focuses on minimizing the impact of short-term risks on ongoing operations.

Circumstances or situations that can negatively impact the success of a project or program, requiring proactive management and mitigation.

A critical component of program-level risk management, providing direction and principles for handling risks within the program.

A framework that outlines the organization's approach to managing risks across all levels, from strategic planning to operational execution.

The context of risk management changes significantly depending on the level it is being applied at. Strategic level focuses on overall business strategy, while operational level centers on day-to-day operations.

Standards and guidance from authoritative bodies providing best practices for managing I&T-related risk.

A comprehensive framework for understanding and managing IT-related risks, providing a framework for identifying, analyzing, and responding to risks across an organization.

A global association focused on IT governance, risk management, and cybersecurity, offering valuable resources and certifications for related professionals.

A framework developed by ISACA offering a comprehensive view of I&T-related risks, aiding organizations in identifying, assessing, and managing those risks effectively.

A renowned framework developed by the Committee of Sponsoring Organizations of the Treadway Commission (COSO), providing a comprehensive approach to enterprise risk management.

A globally recognized standards organization that sets standards for various aspects of information technology, including risk management.

A standard developed by NIST aimed at improving cybersecurity for critical infrastructure, providing guidance on risk management, vulnerability assessments, and incident response.

A framework developed by NIST addressing data security and privacy risks across the lifecycle of information systems, offering guidance on managing and mitigating these risks.