The BEST way to validate that a risk treatment plan has been implemented effectively is by reviewing:
Answer(s): D
A post-implementation RCSA is a process of verifying whether the risk treatment plan has been executed as intended and whether the residual risk is within the acceptable level. It involves testing the effectiveness of the controls that have been implemented to mitigate the risk and identifying any gaps or issues that need to be addressed. A BIA, the original risk response plan, and the training program and user awareness documentationare not sufficient to validate theeffectiveness of the risk treatment plan, as they do not measure the actual performance of the controls or the residual risk.
·ISACA, Risk IT Framework, 2nd Edition, 2019, p. 761 ·ISACA, Risk and Information Systems Control Review Manual, 7th Edition, 2020, p. 2112
Which of the following is the BEST way to promote adherence to the risk tolerance level set by management?
Answer(s): A
According to the Risk Appetite vs. Risk Tolerance: What is the Difference? article, risk tolerance is the acceptable level of variation that an organization is willing to accept around a specific objective. Risk tolerance is usually expressed as a range or a limit, and it helps to guide the decision making and risk taking of the organization. The best way to promote adherence to the risk tolerance level set by management is to define the expectations in the enterprise risk policy, which is a document that establishes the organization's risk management framework, principles, and objectives. By defining the expectations in the enterprise risk policy, the organization can communicate the risk tolerance level to all the relevant stakeholders, and ensure that they understand and follow the risk management guidelines and standards. This can help to create aconsistent and coherent risk culture across the organization, and to avoid any deviations or violations of the risk tolerance level. References = Risk Appetite vs. Risk Tolerance: What is the Difference?
Which of the following is the PRIMARY reason to adopt key control indicators (KCIs) in the risk monitoring and reporting process?
Key control indicators (KCIs) are metrics that measure the performance and effectiveness of the controls that are implemented to mitigate the risks. KCIs can help to monitor the status and health of the controls, as well as to identify any issues or gaps that need to be addressed. The primary reason to adopt KCIs in the risk monitoring and reporting process is to provideassessments of mitigation effectiveness, meaning that they can help to evaluate how well the controls are reducing the risk exposure and achieving the desired outcomes. KCIs can also help to support the risk management decision making and improvement actions, as well as to demonstrate the value and benefits of the controls. References = Risk and Information Systems Control Study Manual, Chapter 3, Section 3.3.1.2, p. 115-116
Which of the following is the BEST method to identify unnecessary controls?
Answer(s): C
The best method to identify unnecessary controls is reviewing system functionalities associated with business processes, because this can help to determine whether the controls are relevant, effective, and efficient for the current business needs and objectives. System functionalities are the capabilities and features of IT systems that support the execution and performance of business processes. Business processes are the set of interrelated activities that transform inputs into outputs to deliver value to customers or stakeholders. By reviewing system functionalities associated with business processes, an organization can assess whether the controls are aligned with the process requirements, expectations, and outcomes, and whether they add value or create waste. The review can also identify any gaps, overlaps, redundancies, or conflicts among the controls, and any changes or improvements that are needed to optimize the controls. The other options are less effective methods to identify unnecessary controls. Evaluating the impact of removing existing controls can help to measure the benefits and costs of the controls, but it does not address the root causes or sources of the unnecessary controls. Evaluating existing controls against audit requirements can help to ensure compliance and assurance, but it does not considerthe business context or purpose of the controls. Monitoring existing key risk indicators (KRIs) can help to measure the level and impact of risks, but it does not evaluate the suitability oradequacy of the controls. References = Surveying Staff to Identify Unnecessary Internal Controls - Methodology and Results
What is the BEST recommendation to reduce the risk associated with potential system compromise when a vendor stops releasing security patches and updates for a business- critical legacy system?
The best recommendation to reduce the risk associated with potential system compromise when a vendor stops releasing security patches and updates for a business-critical legacy system is to segment the system on its own network. Network segmentation is the process of dividing a network into smaller subnetworks or segments, based on different criteria, such as function, location, or security level. Network segmentation helps to isolate the system from the rest of the network, and limit the exposure and access to the system. Network segmentation also helps to improve the performance and security of the network, by reducing the network traffic and congestion, and enhancing the monitoring and control capabilities. The other options are not as effective as segmenting the system on its own network, although they may provide some additional protection or recovery options. Ensuring regular backups take place, virtualizing the system in the cloud, and installing antivirus software on the system are all measures that can helpto reduce the risk of data loss or system damage, but they do not address the root cause of the risk, which is the lack of security patches and updates for the system. References = Risk and Information Systems Control Study Manual, Chapter 3, Section 3.2.1, page 3-11.
Post your Comments and Discuss ISACA CRISC exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CRISC content, but please register or login to continue.