CRISC Domain 1 MCQ (A)

All of the following are factors to consider in asset valuation except which one?

---

• Cost to repair

• Cost to replace

• Revenue the asset generates

• Risk the asset incurs

Which of the following statements best describes the use of contracts between entities?

• Contractual requirements are imposed by legislation and regulatory agencies

• Contractual requirements between two organizations can impose external governance on parties to the contract

• Contractual requirements are imposed by customers and the public

• Contractual requirements are imposed by internal policies

Which of the following defines how an organization’s management feels about and deals with risk?

• Organizational strategy

• Organizational mission

• Organizational goals

• Organizational risk culture

Which of the following is a document that details risks for a particular asset, as well as any planned mitigations and resources committed to the risk management effort?

• Risk register

• Risk appetite

• Risk profile

• Risk tolerance

All the following are effective means to organize inventories of assets except for which one?

• Business process

• Organizational unit

• Geography

• Cost

Which of the following of the three lines of defense concerns the tactical management activities that take place at the business unit or process level?

• Operational management

• Threat management

• Risk and compliance management

• Auditing and accountability

All the following would be considered an organization’s intellectual property except which one?

• Patents

• Software source code

• Trade secrets

• Employee personal information

Which of the following is the amount of loss an organization can incur without seriously affecting its ability to continue as an organization?

• Risk tolerance

• Risk capacity

• Risk appetite

• Risk culture

Which of the following is created to directly support an organization’s risk management policy?

• Risk assessment procedures

• Risk strategy

• Risk methodology

• Risk report

Which of the following is defined by the level of deviation in risk an organization is willing to accept for a particular business venture?

• Risk capacity

• Risk culture

• Risk appetite

• Risk tolerance