CRISC Certified in Risk and Information Systems ControlIT Risk AssessmentMedium
A newly appointed CRISC professional is reviewing the organization's existing risk register. They notice that several entries are vague, lack specific threat sources, and do not clearly link to business objectives. What is the PRIMARY benefit of improving the specificity and detail of risk register entries, especially concerning threat sources and business objectives?
- ATo reduce the overall number of risks in the register.
- BTo enable more effective and targeted risk treatment planning and control implementation.
- CTo simplify the process of risk acceptance by management.
- DTo ensure compliance with general data protection regulations.
Show answer & explanationAnswer & explanation
Correct answer: B. To enable more effective and targeted risk treatment planning and control implementation.
Specific and detailed risk register entries, particularly those identifying clear threat sources and links to business objectives, are crucial for effective risk treatment. This detail allows the organization to develop targeted controls and response plans that directly address the root causes and protect specific objectives, rather than broad, ineffective measures.
Why the other options are wrong
- A. Improving specificity might consolidate some risks but doesn't primarily aim to reduce the overall count; it aims for clarity and actionability.
- C. While clarity helps, the primary benefit isn't just to simplify acceptance, but to inform effective action before acceptance.
- D. While good risk management supports compliance, the primary benefit of improving specificity is operational effectiveness in risk treatment, not just regulatory adherence.
Risk Register Detail
The level of information and specificity included in each entry of a risk register, critical for effective risk management.
- Includes threat, asset, vulnerability, impact, and controls.
- Links risks to business objectives.
- Facilitates clear communication and decision-making.
Memory trick: A detailed risk register is a precise map to effective solutions.