Study. uk . com
  1. Home
  2. All questions
  3. Question 257

CISM study material · question 257 of 1000

Three business units each maintain a risk register using their own categorisation scheme. What consequence does IR 8286 identify?

  1. The registers cannot be audited
  2. The registers cannot readily be compared or consolidated during the risk aggregation step
  3. The registers cannot be used to assign risk owners
  4. Each unit's residual risk will be overstated
Show the answer

Answer: B. The registers cannot readily be compared or consolidated during the risk aggregation step

IR 8286 describes risk category as an organising construct enabling multiple register entries to be consolidated, and states consistent risk categorisation is helpful for comparing registers during the risk aggregation step.

Source: NIST IR 8286 (NIST) — Sec. 3 Risk Register Elements

Challenge yourself on this topic → Study as cards