A risk register is a document that records and tracks the information and status of the identified risks
and their responses. It includes the risk description, category, source, cause, impact, probability,
priority, response, owner, action plan, status, etc.
A risk scenario is a description or representation of a possible or hypothetical situation or event that
may cause or result in a risk for the organization. A risk scenario usually consists of three elements: a
threat or source of harm, a vulnerability or weakness, and an impact or consequence.
Multiple risk practitioners are the individuals or groups that are involved or responsible for the
identification, analysis, evaluation, and communication of the risks and their responses. They may
include the risk owners, risk managers, risk analysts, risk consultants, risk auditors, etc.
A single risk register is a risk register that is shared or used by multiple risk practitioners across the
organization, and that contains the information and status of all the risks and their responses that are
relevant or applicable to the organization.
The most important consideration when multiple risk practitioners capture risk scenarios in a single
risk register is using a consistent method for risk assessment, which is the process of determining the
significance and urgency of the risks that may affect the organization’s objectives and operations.
Risk assessment involves measuring and comparing the likelihood and impact of various risk
scenarios, and prioritizing them based on their magnitude and importance.
Using a consistent method for risk assessment when multiple risk practitioners capture risk scenarios
in a single risk register ensures that the risk scenarios are captured and recorded in a uniform and
standardized way, and that they are comparable and compatible with each other. It alsohelps to
avoid or reduce the inconsistencies, discrepancies, or conflicts that may arise from the different
perspectives, assumptions, or judgments of the multiple risk practitioners, and to ensure the
accuracy, reliability, and validity of the risk register.
The other options are not the most important considerations when multiple risk practitioners
capture risk scenarios in a single risk register, because they do not address the main challenge or
issue that may arise from the multiple risk practitioners capturing risk scenarios in a single risk
register, which is the lack of consistency or standardization in the risk assessment method.
Aligning risk ownership and control ownership means ensuring that the individuals or groups that are
accountable and responsible for the risks and their responses are clearly defined and assigned, and
that they have the authority and resources to perform their roles and duties. Aligning risk ownership
and control ownership is important when multiple risk practitioners capture risk scenarios in a single
risk register, but it is not the most important consideration, because it does not ensure that the risk
scenarios are captured and recorded in a uniform and standardized way, and that they are
comparable and compatible with each other.
Developing risk escalation and reporting procedures means establishing and implementing the
processes and guidelines for communicating and sharing the information and status of the risks and
their responses among the relevant stakeholders, and for escalating or transferring the risks and
their responses to the appropriate levels or parties when necessary or required. Developing risk
escalation and reporting procedures is important when multiple risk practitioners capture
riskscenarios in a single risk register, but it is not the most important consideration, because itdoes
not ensure that the risk scenarios are captured and recorded in a uniform and standardized way, and
that they are comparable and compatible with each other.
Maintaining up-to-date risk treatment plans means updating and revising the actions or plans that
are selected and implemented to address or correct the risks and their responses, based on the
changes or developments that may occur in the risk environment or performance. Maintaining up-
to-date risk treatment plans is important when multiple risk practitioners capture risk scenarios in a
single risk register, but it is not the most important consideration, because it does not ensure that the
risk scenarios are captured and recorded in a uniform and standardized way, and that they are
comparable and compatible with each other. Reference =
ISACA, CRISC Review Manual, 7th Edition, 2022, pp. 19-20, 23-24, 27-28, 31-32, 40-41, 47-48, 54-55,
58-59, 62-63
ISACA, CRISC Review Questions, Answers & Explanations Database, 2022, QID 178
CRISC Practice Quiz and Exam Prep
