CRISC Question 89

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose C1

  • A. Capability Maturity Models (CMMs): Measures the maturity or sophistication of processes, not their day-to-day operational effectiveness. • B. Metric thresholds: These are limits or benchmarks, but by themselves don’t indicate overall effectiveness—they are just reference points. • C. Key Risk Indicators (KRIs): ✅ KRIs are metrics specifically designed to monitor the level of risk exposure and the effectiveness of risk management controls. They directly show whether risk management is working operationally. • D. Key Performance Indicators (KPIs): KPIs measure general business performance, not specifically risk management effectiveness. Correct answer: C. Key Risk Indicators (KRIs) ✅ KRIs provide quantifiable measures of risk levels and control effectiveness, making them the best choice for assessing operational risk management.

• Chose A1

  CMMs measure the maturity of risk management processes, how well risk management is defined, repeatable, managed, and optimized.KPIs show outcomes, but they don’t necessarily show how mature or effective your risk management capability as a whole is.