Inspirational journeys

Follow the stories of academics and their research expeditions

CRISC—Certified in Risk and Information Systems Control Certification Questions and answer - Part 5

Mary Smith

Sat, 18 Apr 2026

CRISC—Certified in Risk and Information Systems Control Certification Questions and answer - Part 5

1. While considering entity-based risks, which dimension of the COSO ERM framework is being referred?

A) Organizational levels
B) Risk components
C) Strategic objectives
D) Risk objectives



2. You are the project manager for Bluewell Inc. You are studying the documentation of project plan. The documentation states that there are twenty-five stakeholders with the project. What will be the number of communication channel s for the project?

A) 20
B) 100
C) 50
D) 300



3. Which of the following are the common mistakes while implementing KRIs?Each correct answer represents a complete solution. Choose three.(Select 3answers)

A) Choosing KRIs that are difficult to measure
B) Choosing KRIs that has high correlation with the risk
C) Choosing KRIs that are incomplete or inaccurate due to unclear specifications
D) Choosing KRIs that are not linked to specific risk



4. Which of the following control audit is performed to assess the efficiency of the productivity in the operations environment?

A) Operational
B) Financial
C) Administrative
D) Specialized



5. Billy is the project manager of the HAR Project and is in month six of the project. The project is scheduled to last for 18 months.Management asks Billy how often the project team is participating in risk reassessment in this project. What should Billy tell management if he's following the best practices for risk management?

A) Project risk management has been concluded with the project planning.
B) Project risk management happens at every milestone.
C) Project risk management is scheduled for every month in the 18-month project.
D) At every status meeting the project team project risk management is an agenda item.



1. Right Answer: A
Explanation: The organizational levels of the COSO ERM framework describe the subsidiary, business unit, division, and entity-levels of aspects of risk solutions.Incorrect Answers:B: Risk components includes Internal Environment, Objectives settings, Event identification, Risk assessment, Risk response, Control activities, Information and communication, and monitoring.C: Strategic objectives includes strategic, operational, reporting, and compliance risks; and not entity-based risks.D: This is not a valid answer.

2. Right Answer: D
Explanation: Communication channels are paths of communication with stakeholders in a project. The number of communication channels shows the complexity of a project's communication and can be derived through the formula shown below:Total Number of Communication Channels = n (n-1)/2where n is the number of stakeholders.Hence, a project having five stakeholders will have ten communication channels. Putting the value of the number of stakeholders in the formula will provide the number of communication channels.Hence,Number of communication channel = (n (n-1)) / 2= (25 (25-1)) / 2= (25 x 24) / 2= 600 / 2= 300Incorrect Answers:A, B, C: These are not valid number of communication channels for the given scenario.

3. Right Answer: A,C,D
Explanation: A common mistake when implementing KRIs other than selecting too many KRIs includes choosing KRIs that are: Not linked to specific risk Incomplete or inaccurate due to unclear specifications Too generic Difficult to aggregate, compare and interpret Difficult to measureIncorrect Answers:B: For ensuring high reliability of the KRI, The indicator must possess a high correlation with the risk and be a good predictor or outcome measure. Hence KRIs are chosen that has high correlation with the risk.

4. Right Answer: C
Explanation: The administrative audit is used to assess the efficiency of the productivity in the operations environment.Incorrect Answers:A: It evaluates the internal control structure of process of functional area.B: Audits that assesses the correctness of financial statements is called financial audit.D: They are the IS audits with specific intent to examine areas, such as processes, services, or technologies, usually by third party auditors.

5. Right Answer: D
Explanation: Risk management is an ongoing project activity. It should be an agenda item at every project status meeting.Incorrect Answers:A: Risk management happens throughout the project as does project planning.B: Milestones are good times to do reviews, but risk management should happen frequently.C: This answer would only be correct if the project has a status meeting just once per month in the project.

0 Comments

Leave a comment