Certified Risk and Information Systems Control (CRISC) Practice Evaluation

Identifying Enterprise Standing and Priority Improvements in Risk Management

Prev Question Next Question

Question

You are the project manager of your enterprise.

While performing risk management, you are given a task to identify where your enterprise stands in certain practice and also to suggest the priorities for improvements.

Which of the following models would you use to accomplish this task?

Answers

Explanations

Click on the arrows to vote for the correct answer

A. B. C. D.

A.

Capability maturity models are the models that are used by the enterprise to rate itself in terms of the least mature level (having nonexistent or unstructured processes) to the most mature (having adopted and optimized the use of good practices)

The levels within a capability maturity model are designed to allow an enterprise to identify descriptions of its current and possible future states.

In general, the purpose is to: -> Identify, where enterprises are in relation to certain activities or practices.

-> Suggest how to set priorities for improvements Incorrect Answers: D: There is no such model exists in risk management process.

B: Decision tree analysis is a risk analysis tool that can help the project manager in determining the best risk response.

The tool can be used to measure probability, impact, and risk exposure and how the selected risk response can affect the probability and/or impact of the selected risk event.

It helps to form a balanced image of the risks and opportunities connected with each possible course of action.

This makes them mostly useful for choosing between different strategies, projects, or investment opportunities particularly when the resources are limited.

A decision tree is a decision support tool that uses a tree-like graph or model of decisions and their possible consequences, including chance event outcomes, resource costs, and utility.

C: Fishbone diagrams or Ishikawa diagrams shows the relationships between the causes and effects of problems.

As the project manager of your enterprise, you have been tasked with identifying where your organization stands in a certain practice and suggesting priorities for improvements as part of your risk management process. To accomplish this task, you can use the Capability Maturity Model (CMM).

The Capability Maturity Model is a framework that helps organizations improve their processes and practices. It is designed to provide a roadmap for organizations to move from an ad-hoc, unstructured approach to one that is mature, disciplined, and optimized. The model provides a set of guidelines for measuring and improving an organization's capability in a particular area.

The Capability Maturity Model consists of five levels of maturity, with each level building upon the previous level. The levels are:

  1. Initial: The organization's processes are ad-hoc and unstructured.
  2. Repeatable: The organization has developed basic processes that can be repeated.
  3. Defined: The organization has developed a set of standard processes.
  4. Managed: The organization has implemented quantitative methods for managing processes.
  5. Optimized: The organization has implemented continuous process improvement.

Using the Capability Maturity Model, you can assess where your enterprise stands in a particular practice by identifying the current level of maturity for that practice. You can then identify the priorities for improvement by determining which level of maturity your enterprise needs to achieve and what steps are required to get there.

In summary, the Capability Maturity Model is an effective tool for assessing an organization's capability in a particular area and identifying priorities for improvement. By using this model, you can ensure that your enterprise is continuously improving its processes and practices, which is critical for managing risks and achieving organizational objectives.