- (Exam Topic 2)
The PRIMARY purpose of using control metrics is to evaluate the:

1. A. amount of risk reduced by compensating controls.
2. B. amount of risk present in the organization.
3. C. variance against objectives.
4. D. number of incidents.

Correct Answer: C

- (Exam Topic 2)
A department has been granted an exception to bypass the existing approval process for purchase orders. The risk practitioner should verify the exception has been approved by which of the following?

1. A. Internal audit
2. B. Control owner
3. C. Senior management
4. D. Risk manager

Correct Answer: B

- (Exam Topic 4)
An organization's chief information officer (CIO) has proposed investing in a new. untested technology to take advantage of being first to market Senior management has concerns about the success of the project and has set a limit for expenditures before final approval. This conditional approval indicates the organization's risk:

1. A. capacity.
2. B. appetite.
3. C. management capability.
4. D. treatment strategy.

Correct Answer: B

- (Exam Topic 4)
Which of the following is the BEST method of creating risk awareness in an organization?

1. A. Marking the risk register available to project stakeholders
2. B. Ensuring senior management commitment to risk training
3. C. Providing regular communication to risk managers
4. D. Appointing the risk manager from the business units

Correct Answer: B

- (Exam Topic 3)
Which of the following presents the GREATEST risk to change control in business application development over the complete life cycle?

1. A. Emphasis on multiple application testing cycles
2. B. Lack of an integrated development environment (IDE) tool
3. C. Introduction of requirements that have not been approved
4. D. Bypassing quality requirements before go-live

Correct Answer: C