Question

A newly appointed CRISC-certified risk practitioner reviews the enterprise risk register and finds that many identified risks are documented in technical terms with no reference to how they could affect the organization's stated growth and market-expansion strategy. Senior management complains that risk reports are not useful for decision-making. What should the practitioner do FIRST to address this concern?

Accepted Answer

Map identified risks to the organization's strategic goals and objectives so their potential business impact is clearly expressed

Answer

Escalate the poorly written risk entries to the internal audit function for corrective action

Answer

Increase the frequency of risk register updates to ensure management receives more current information

Answer

Replace the qualitative risk descriptions with quantitative loss estimates for every entry