CRISC Question 376

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose C1

  C. Risk register. When reviewing the overall risk profile of a targeted organization as part of an acquisition consideration, the "C. Risk register" would provide the most useful information. The risk register contains a comprehensive list of identified risks, their associated attributes, and relevant details. By analyzing the risk register, the acquiring organization can gain insights into the specific risks that the targeted organization faces, the potential impact of those risks, and the existing risk management efforts. While the other components (risk appetite statement, risk management policies, enterprise risk management framework) are also important in understanding the risk management approach of the targeted organization, the risk register provides a detailed and practical view of the specific risks that need to be assessed and managed in the context of the acquisition.

• 1

  By reviewing the targeted organization's risk register, the acquiring organization would gain insight into the types of risks that the targeted organization faces, the potential impact of those risks, and the controls that have been put in place to manage those risks. This information would be critical in assessing the overall risk profile of the targeted organization and determining the potential risks associated with the acquisition.

• Chose C1

  It is C.