Study. uk . com
  1. Home
  2. All questions
  3. Question 73

CISM study material · question 73 of 1000

An enterprise risk committee receives risk input, but human resources, legal, audit and compliance are unaware of its work and of the subordinate councils feeding it. What does IR 8286 recommend?

  1. Restricting risk information to the committee itself, so that confidentiality is preserved and partial findings do not circulate early
  2. Communicating the relationships among the risk bodies clearly, so supporting groups stay connected to the process
  3. Merging all supporting groups into the committee
  4. Requiring each supporting group to maintain its own separate register, so that the committee receives a single consolidated view only once a year
Show the answer

Answer: B. Communicating the relationships among the risk bodies clearly, so supporting groups stay connected to the process

IR 8286 asks that relationships among risk entities be communicated clearly — such as how a formal enterprise risk committee is informed by subordinate councils — to ensure cross-communication with human resources, legal, auditing and compliance.

Source: NIST IR 8286 (NIST) — Sec. 3.1.1 Notional Risk Management Roles

Challenge yourself on this topic → Study as cards