According to the CRISC Review Manual (Digital Version), the primary reason a risk practitioner would be interested in an internal audit report is to evaluate the maturity of the risk management process, as it provides an independent and objective assessment of the effectiveness and efficiency of the risk management activities and controls. An internal audit report helps to:
* Identify and evaluate the strengths and weaknesses of the risk management process and its alignment with the organization's objectives and strategy
* Detect and report any gaps, errors, or deficiencies in the risk identification, assessment, response, and monitoring processes and controls
* Recommend and implement corrective actions or improvement measures to address the issues or findings in the risk management process
* Communicate and coordinate the audit results and recommendations with the relevant stakeholders, such as the risk owners, the senior management, and the board
* Enhance the accountability and transparency of the risk management process and its outcomes References = CRISC Review Manual (Digital Version), Chapter 4: IT Risk Monitoring and Reporting, Section
4.2: IT Risk Reporting, pp. 223-2241

Section: Volume A
Explanation:
The Delphi technique uses rounds of anonymous surveys to build consensus on project risks. Delphi is a technique to identify potential risk. In this technique, the responses are gathered via a question and their inputs are organized according to their contents. The collected responses are sent back to these experts for further input, addition, and comments. The final list of risks in the project is prepared after that. The participants in this technique are anonymous and therefore it helps prevent a person from unduly influencing the others in the group. The Delphi technique helps in reaching the consensus quickly.
Incorrect Answers:
B: Root cause analysis is not an anonymous approach to risk identification.
C: Isolated pilot groups is not a valid risk identification activity.
D: SWOT analysis evaluates the strengths, weaknesses, opportunities, and threats of the project.

Section: Volume D

Explanation/Reference:
Explanation:
Risk avoidance involves changing the project management plan to eliminate the threat entirely. The project manager may also isolate the project objectives from the risk's impact or change the objective that is in jeopardy. Examples of this include extending the schedule, changing the strategy, or reducing the scope.
The most radical avoidance strategy is to shut down the project entirely. Some risks that arise early in the project can be avoided by clarifying requirements, obtaining information, improving communication, or acquiring expertise.
Incorrect Answers:
A: Exploit risk response is used for positive risk or opportunity, not for negative risk.
B: This risk response does require a change request, in some instances, but it's the avoidance risk response and not just a change request.
D: Transference allows the risk to be transferred, not removed from the project, to a third party.
Transference usually requires a contractual relationship with the third party.