During a risk assessment, the risk practitioner finds a new risk scenario without controls has been entered into the risk register. Which of the following is the MOST appropriate action?
Answer(s): A
A new risk scenario without controls means that there is a potential threat or event that could adversely affect the organization's objectives, and there are no existing measures to prevent or reduce the impact or likelihood of the risk. Therefore, the most appropriate action is to include the new risk scenario in the current risk assessment, so that the risk practitioner can analyze therisk, evaluate its severity and priority, and recommend suitable controls to mitigate the risk. By including the new risk scenario in the current riskassessment, the risk practitioner can ensure that the risk register is updated and reflects the current risk profile of the organization. The other options are not appropriate because they either ignore the new risk scenario, delay the risk assessment process, or remove valuable information from the risk register. References = Risk and Information Systems Control Study Manual, Chapter 3, Section 3.4.1, page 95.
An organization has restructured its business processes, and the business continuity plan (BCP) needs to be revised accordingly. Which of the following should be identified FIRST?
Answer(s): C
When an organization restructures its business processes, the first step in revising the BCP is to identify new potentially disruptive scenarios that may affect the continuity of the critical functions and processes. This can be done by conducting a risk assessment or a business impact analysis (BIA) to determine the likelihood and impact of various threats and vulnerabilities onthe organization's objectives and operations. By identifying new potentially disruptive scenarios, the organization can then update its recovery strategies, objectives, and plans accordingly.
·ISACA, Risk IT Framework, 2nd Edition, 2019, p. 761 ·ISACA, IT Business Continuity/Disaster Recovery Audit Program, 2021, p. 52
Which of the following is MOST useful when performing a quantitative risk assessment?
Answer(s): B
When outsourcing a business process to a cloud service provider, it is MOST important to understand that:
Answer(s): D
According to the FIC Article by FSCA, accountable institutions remain fully accountable, responsible and liable for any compliance failures that may result from or be associated with an outsourcing arrangement and as such, liability and/or culpability for non-compliance with the FIC Act obligations cannot be transferred to a third-party service provider2. Therefore, even if a business process is outsourced to a cloud service provider, the organization still has the ultimate responsibility and accountability for the risk associated with the outsourced process. The other options are not correct, as they imply that the cloud service provider can take over the accountability or responsibility for the risk, or that the organization can mitigate the risk by acquiring insurance, which is not the case.
Which of the following is the BEST recommendation to address recent IT risk trends that indicate social engineering attempts are increasing in the organization?
The best recommendation to address recent IT risk trends that indicate social engineering attempts are increasing in the organization is to conduct a simulated phishing attack, as it tests the awareness and behavior of the employees in responding to a realistic and targeted email scam, and identifies the areas and individuals that need improvement or training. Updating spam filters, revising the acceptable use policy, and strengthening disciplinary procedures are not the best recommendations, as they may not address the human factor of the risk, or may be too reactive or punitive, respectively. References = CRISC Review Manual, 7th Edition, page 155.
Post your Comments and Discuss ISACA CRISC exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CRISC content, but please register or login to continue.