Inspirational journeys

Follow the stories of academics and their research expeditions

CRISC—Certified in Risk and Information Systems Control Certification Questions and answer - Part 48

Mary Smith

Thu, 16 Apr 2026

CRISC—Certified in Risk and Information Systems Control Certification Questions and answer - Part 48

1. Mary is a project manager in her organization. On her current project she is working with her project team and other key stakeholders to identify the risks within the project. She is currently aiming to create a comprehensive list of project risks so she is using a facilitator to help generate ideas about project risks. What risk identification method is Mary likely using?

A) Delphi Techniques
B) Expert judgment
C) Brainstorming
D) Checklist analysis



2. Which of the following is an administrative control?

A) Water detection
B) Reasonableness check
C) Data loss prevention program
D) Session timeout



3. You are the project manager of the NHH Project. You are working with the project team to create a plan to document the procedures to manage risks throughout the project. This document will define how risks will be identified and quantified. It will also define how contingency plans will be implemented by the project team.What document do you and your team is creating in this scenario?

A) Project plan
B) Resource management plan
C) Project management plan
D) Risk management plan



4. Where are all risks and risk responses documented as the project progresses?

A) Risk management plan
B) Project management plan
C) Risk response plan
D) Risk register



5. A part of a project deals with the hardware work. As a project manager, you have decided to hire a company to deal with all hardware work on the project. Which type of risk response is this?

A) Transference
B) Mitigation
C) Avoidance
D) Exploit



1. Right Answer: C
Explanation: Mary is using brainstorming in this example. Brainstorming attempts to create a comprehensive list of risks and often is led by a moderator or facilitator to move the process along.Brainstorming is a technique to gather general data. It can be used to identify risks, ideas, or solutions to issues by using a group of team members or subject- matter expert. Brainstorming is a group creativity technique that also provides other benefits, such as boosting morale, enhancing work enjoyment, and improving team work.Incorrect Answers:A: The Delphi technique uses rounds of anonymous surveys to generate a consensus on the identified risks.B: Expert judgment is not the best answer for this; projects experts generally do the risk identification, in addition to the project team.D: Checklist analysis uses historical information and information from similar projects within the organization's experience.

2. Right Answer: C
Explanation:

3. Right Answer: D
Explanation: The risk management plan, part of the comprehensive management plan, defines how risks will be identified, analyzed, monitored and controlled, and even responded to.A Risk management plan is a document arranged by a project manager to estimate the effectiveness, predict risks, and build response plans to mitigate them. It also consists of the risk assessment matrix.Risks are built in with any project, and project managers evaluate risks repeatedly and build plans to address them. The risk management plan consists of analysis of possible risks with both high and low impacts, and the mitigation strategies to facilitate the project and avoid being derailed through which the common problems arise. Risk management plans should be timely reviewed by the project team in order to avoid having the analysis become stale and not reflective of actual potential project risks. Most critically, risk management plans include a risk strategy for project execution.Incorrect Answers:A: The project plan is not an official PMBOK project management plan.B: The resource management plan defines the management of project resources, such as project team members, facilities, equipment, and contractors.C: The project management plan is a comprehensive plan that communicates the intent of the project for all project management knowledge areas.

4. Right Answer: D
Explanation: All risks, their responses, and other characteristics are documented in the risk register. As the project progresses and the conditions of the risk events change, the risk register should be updated to reflect the risk conditions.Incorrect Answers:A: The risk management plan addresses the project management's approach to risk management, risk identification, analysis, response, and control.B: The project management plan is the overarching plan for the project, not the specifics of the risk responses and risk identification.C: The risk response plan only addresses the planned risk responses for the identified risk events in the risk register.

5. Right Answer: A
Explanation: When you are hiring a third party to own risk, it is known as transference risk response.Risk transfer means that impact of risk is reduced by transferring or otherwise sharing a portion of the risk with an external organization or another internal entity.Transfer of risk can occur in many forms but is most effective when dealing with financial risks. Insurance is one form of risk transfer.Incorrect Answers:B: The act of spending money to reduce a risk probability and impact is known as mitigation.C: When extra activities are introduced into the project to avoid the risk, this is an example of avoidance.D: Exploit is a strategy that may be selected for risks with positive impacts where the organization wishes to ensure that the opportunity is realized.

0 Comments

Leave a comment