QUESTION: 129

You are the product manager in your enterprise. You have identified that new technologies, products and services are introduced in your enterprise time-to-time. What should be done to prevent the efficiency and effectiveness of controls due to these changes?

Receive timely feedback from risk assessments and through key risk indicators, and update controls
Add more controls
Perform Business Impact Analysis (BIA)
Nothing, efficiency and effectiveness of controls are not affected by these changes

Answer(s): A

Explanation:

As new technologies, products and services are introduced, compliance requirements become more complex and strict; business processes and related information flows change over time. These changes can often affect the efficiency and effectiveness of controls. Formerly effective controls become inefficient, redundant or obsolete and have to be removed or replaced.

Therefore, the monitoring process has to receive timely feedback from risk assessments and through key risk indicators (KRIs) to ensure an effective control life cycle.

Incorrect Answers:
B: Most of the time, the addition of controls results in degradation of the efficiency and profitability of a process without adding an equitable level of corresponding risk mitigation, hence better controls are adopted in place of adding more controls.

C: A BIA is a discovery process meant to uncover the inner workings of any process. It helps to identify about actual procedures, shortcuts, workarounds and the types of failure that may occur. It involves determining the purpose of the process, who performs the process and its output. It also involves determining the value of the process output to the enterprise.

D: Efficiency and effectiveness of controls are not affected by the changes in technology or product, so some measure should be taken.

Reveal Solution Next Question

QUESTION: 130

Which of the following are sub-categories of threat?
Each correct answer represents a complete solution. Choose three.

Natural and supernatural
Computer and user
Natural and man-made
Intentional and accidental
External and internal

Answer(s): C,D,E

Explanation:

A threat is any event which have the potential to cause a loss. In other word, it is any activity that represents a possible danger. The loss or danger is directly related to one of the following:
Loss of confidentiality- Someone sees a password or a company's secret formula, this is referred to as loss of confidentiality. Loss of integrity- An e-mail message is modified in transit, a virus infects a file, or someone makes unauthorized changes to a Web site is referred to as loss of integrity.
Loss of availability- An e-mail server is down and no one has e-mail access, or a file server is down so data files aren't available comes under loss of availability.

Threat identification is the process of creating a list of threats. This list attempts to identify all the possible threats to an organization. The list can be extensive.

Threats are often sub-categorized as under:
External or internal- External threats are outside the boundary of the organization. They can also be thought of as risks that are outside the control of the organization. While internal threats are within the boundary of the organization. They could be related to employees or other personnel who have access to company resources. Internal threats can be related to any hardware or software controlled by the business.
Natural or man-made- Natural threats are often related to weather such as hurricanes, tornadoes, and ice storms. Natural disasters like earthquakes and tsunamis are also natural threats. A human or man-made threat is any threat which is caused by a person. Any attempt to harm resources is a man-made threat. Fire could be man-made or natural depending on how the fire is started.
Intentional or accidental- An attempt to compromise confidentiality, integrity, or availability is intentional. While employee mistakes or user errors are accidental threats. A faulty application that corrupts data could also be considered accidental.

Reveal Solution Next Question

QUESTION: 131

You work as a project manager for BlueWell Inc. Your project is using a new material to construct a large warehouse in your city. This new material is cheaper than traditional building materials, but it takes some time to learn how to use the material properly. You have communicated to the project stakeholders that you will be able to save costs by using the new material, but you will need a few extra weeks to complete training to use the materials. This risk response of learning how to use the new materials can also be known as what term?

Benchmarking
Cost-benefits analysis
Cost of conformance to quality
Team development

Answer(s): C

Explanation:

When the project team needs training to be able to complete the project work it is a cost of conformance to quality.

The cost of conformance to quality defines the cost of training, proper resources, and the costs the project must spend in order to ascertain the expected levels of quality the customer expects from the project. It is the capital used up throughout the project to avoid failures. It consists of two types of costs:
Prevention costs: It is measured to build a quality product. It includes costs in training, document processing, equipment, and time to do it right.
Appraisal costs: It is measured to assess the quality. It includes testing, destructive testing loss, and inspections.

Incorrect Answers:
A: Benchmarking compares any two items, such as materials, vendors, or resources.

B: Cost-benefit analysis is the study of the benefits in relation to the costs to receive the benefits of a decision, a project, or other investment.

D: Team development describes activities the project manager uses to create a more cohesive and responsive project team.

Reveal Solution Next Question

QUESTION: 132

What is the PRIMARY objective difference between an internal and an external risk management assessment reviewer?

In quality of work
In ease of access
In profession
In independence

Answer(s): D

Explanation:

Independence is the freedom from conflict of interest and undue influence. By the mere fact that the external auditors belong to a different entity, their independence level is higher than that of the reviewer inside the entity for which they are performing a review. Independence is directly linked to objectivity.

Incorrect Answers:
A, B, C: These all choices vary subjectively.

Reveal Solution Next Question

Free CRISC Exam Braindumps (page: 33)

QUESTION: 129

Explanation:

QUESTION: 130

Explanation:

QUESTION: 131

Explanation:

QUESTION: 132

Explanation: