Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Secret > Introduction to IT Risk Management > Flashcards

Introduction to IT Risk Management Flashcards

1
Q

Risk

A

Combination of the probability of an event and its consequence; can also be an adverse event that can threaten an organization’s assets, exploit its vulnerabilities, and cause harm

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Governance

A

Accountability for protection of the assets of an organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Who is accountable for governance?

A

Board of Directors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Who is responsible for managing the day-to-day operations of the organization in alignment with strategic mandates approved by the board?

A

Senior management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

An important part of governance

A

Risk management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Corporate governance

A

The system by which organizations are evaluated, directed, and controlled

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Corporate governance of IT

A

The system by which the current and future use of IT is evaluated, directed, and controlled

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

The objective of any governance system

A

To enable organizations to create value for their stakeholders

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

The governance objective of any organization

A

Value creation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Value creation is comprised of…

A
  1. Benefits realization
  2. Risk optimization
  3. Resource optimization
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Governance answers which four questions?

A
  1. Are we doing the right things?
  2. Are we doing them the right way?
  3. Are we getting them done well?
  4. Are we getting the benefits?
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Management focuses on

A

planning, building, running and monitoring within the directions set by the governance system to create value by achieving objectives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Risk management foresees

A

the challenges to achieving these objectives and attempts to lower the chances and impacts of them occurring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

4 main objectives of risk governance

A
  1. Establish and maintain a common risk view
  2. Integrate risk management into the enterprise
  3. Make risk-aware business decisions
  4. Ensure that risk management controls are implemented and operating correctly
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

The risk governance function must oversee the operations of the ____

A

Risk management team

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Effective risk governance establishes the ___ of risk for the enterprise

A

Common view

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is a holistic ERM (enterprise risk management)?

A

Integrating risk management across the enterprise into every department, function,system, and geographic location

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is the objective of ERM?

A

To establish the authority to require all business processes to undergo a risk analysis on a periodic basis or when there is a significant change to the internal/external environment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

How do we make a risk-aware business decision?

A

The risk governance function must consider the full range of opportunities and consequences of each such decision and its impact on the enterprise, society, and environment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Governance requires ___ and ____ to ensure that the enterprise is following up on the implementation and monitoring of controls to ensure that the controls are effective to mitigate risk and protect organizational assets.

A

Oversight and due diligence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is risk management?

A

Coordinated activities to direct and control an enterprise with regard to risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Risk

A

A challenge to achieving objectives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Risk management as an activity

A

Undertaken to foresee challenges and lower the chances of those challenges occurring and their impact

24
Q

ISO

A

International Organization for Standardization

25
Q

IEC

A

International Electrotechnical Commission

26
Q

What does ISO/IEC 31000 state about risk?

A

Risk is the effect of uncertainty on objectives. An effect is a deviation from the expected - positive and/or negative.

27
Q

What does ISO/IEC 27005 state?

A

Information security risk is the potential that a given threat will exploit vulnerabilities of an asset or group of assets and thereby cause harm to the organization.

28
Q

Risk management starts with..

A

understanding the organization

29
Q

How do you assess an organization’s context?

A

Evaluating the intent of capability of threats; the relative value of, and trust required in, assets, and the respective relationship of vulnerabilities that threats could exploit

30
Q

Considerations in risk management:

A
  1. Vulnerability to changes in economic and political conditions
  2. Changes in market trends and patterns
  3. Emergence of new competition
  4. Impact of new legislation
  5. Existence of potential natural disaster
  6. Constraints caused by legacy systems
  7. Strained labor relations and inflexible management
31
Q

Risk is an influencing factor that must be evaluated at the following levels:

A
  1. Strategic level
  2. Business unit level
  3. Information Systems level
32
Q

IT risk management is…

A

the implementation of a risk strategy that reflects the culture,appetite, and tolerance levels of the senior management; considers technology and budgets; and addresses the requirements of regulation and compliance

33
Q

IT Risk Identification

A

Includes determining the risk context and risk framework; the process of identifying and documenting risk; should result in listing and documenting of risk; first step in the IT risk management life cycle

34
Q

IT Risk Assessment

A

Second step in the IT risk management cycle; the effort to assess risk, including prioritization of risk

35
Q

IT Risk Response and Mitigation

A

Third step in the IT risk management cyvle; address the risk appetite and tolerance of the organization and the need to find cost-effective ways to address risk

36
Q

IT Risk and Control Monitoring and Reporting

A

Fourth step in the IT risk management cycle; controls and risk management efforts are monitored and results are reported back to senior management

37
Q

Who determines the need to return to other phases of the IT risk management life cycle?

A

Senior management

38
Q

What is IT’s primary responsibility?

A

To support business requirements

39
Q

The relationship between IT and the business unit is a

A

CSF (Critical Success Factor)

40
Q

IT risk strategy is driven by

A

business risk strategy

41
Q

IT risk assessment is a precursor to

A

BIA (business impact analysis)

42
Q

Business continuity starts where

A

risk management ends

43
Q

BCP

A

business continuity plan

44
Q

Provides assurance to management on the effectiveness of the IS control framework, IT risk management, and compliance

A

IS Audit

45
Q

Risks associated with IS Audit

A
  1. Competence of the IS Audit personnel

2. Independence of the audit

46
Q

Information security is usually based on

A

risk

47
Q

NIST

A

National Institute of Standards and Technology

48
Q

The effectiveness of the information security program is based on…

A

a foundation of thorough and accurate IT risk management

49
Q

IT risk drives…

A

the selection of controls and justifies the choice and operation of a control

50
Q

Every control should be traced back to

A

a specific IT risk that the control is designed to mitigate

51
Q

Control Risk

A

Risk of:

  1. selection of wrong control
  2. incorrect configuration of the control
  3. improper operation of the control
  4. failure to monitor and review the control
  5. inadequacy of the control to address new threats
52
Q

Project Risk

A

Risk that a project may fail

53
Q

Determining project failure:

A
  1. Over budget
  2. Over the allotted time schedule
  3. Failure to meet customer needs and expectations
54
Q

Change Risk

A 
Risk from changes in:
1. Technology
2. Regulations
3. Business process
4. Functionality
5. Architecture
6. Users
7. Operational environment
rendering the original controls ineffective
55
Q

Important task of the risk practioner

A

manage risk on a continuous basis and to be aware of emerging risk, new threats, new technologies,changes in culture, and increased legislation and/or regulation

Secret (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions