Certified in Risk and Information Systems Control (CRISC) — Question 379

Which of the following is NOT true for risk governance?

Answer options

• A. Risk governance is based on the principles of cooperation, participation, mitigation and sustainability, and is adopted to achieve more effective risk management.
• B. Risk governance requires reporting once a year.
• C. Risk governance seeks to reduce risk exposure and vulnerability by filling gaps in risk policy.
• D. Risk governance is a systemic approach to decision making processes associated to natural and technological risks.

Correct answer: B

Explanation

The correct answer is B, as risk governance does not mandate annual reporting, which is not a standard requirement. Options A, C, and D accurately describe aspects of risk governance, emphasizing its principles, objectives, and systematic approach.