Which of the following will BEST ensure that controls adequately support business goals and objectives?
Answer(s): A
Using the risk management process will best ensure that controls adequately support business goals and objectives, as it involves identifying, assessing, responding, and monitoring the risks that may affect the achievement of the business goals and objectives, and designing and implementing controls to mitigate those risks. Enforcing strict disciplinary procedures in case of noncompliance, reviewing results of the annual company external audit, and adopting internationally accepted controls are also good practices, but they are not the best, as they do not necessarily align the controls with the business goals and objectives. References = CRISC Review Manual, 7th Edition, page 146.
Senior management has requested more information regarding the risk associated with introducing a new application into the environment. Which of the following should be done FIRST?
Answer(s): B
Understanding Risk Analysis:Risk analysis involves identifying potential risks associated with a new application and assessing their likelihood and impact on the organization. It provides a detailed understanding of the potential threats, vulnerabilities, and consequences, enabling informed decision-making.Steps in Conducting a Risk Analysis:Identify Risks:Determine what risks could arise from the new application, including security vulnerabilities, compliance issues, and operational disruptions. Assess Risks:Evaluate the likelihood and impact of each identified risk. This includes both qualitative and quantitative assessments.Prioritize Risks:Rank the risks based on their assessed impact and likelihood to focus on the most significant threats first.Importance of Risk Analysis:Provides senior management with a comprehensive view of the risks involved, enabling them to make informed decisions about proceeding with the application. Helps in developing mitigation strategies to address the identified risks.Comparing Other Options:Perform an Audit:Audits are useful for evaluating existing controls but are not the first step in assessing risks for a new application.Develop Risk Scenarios:This is part of the risk analysis process but comes after identifying and assessing risks.Perform a Cost-Benefit Analysis:Important for decision-making but follows the initial risk analysis to understand potential impacts.
The CRISC Review Manual emphasizes the importance of conducting a risk analysis to understand and manage risks associated with new applications (CRISC Review Manual, Chapter 2: IT Risk Assessment, Section 2.2.1 Conducting Risk Analysis) .
An organization has operations in a location that regularly experiences severe weather events. Which of the following would BEST help to mitigate the risk to operations?
Answer(s): D
The best way to mitigate the risk to operations caused by severe weather events is to develop a business continuity plan (BCP). A BCP is a document that describes the procedures and resources needed to ensure the continuity of the organization's critical functions and processes in the event of a disruption or disaster. A BCP helps to identify the recovery objectives, strategies, and priorities, as well as the roles and responsibilities of the recovery team members. A BCP also helps to prepare and test the recovery capabilities and resources, such as alternate locations, backup systems, and communication channels. The other options are not as effective as developing a BCP, although they may be part of the BCP process or outcomes. Preparing a cost-benefit analysis to evaluate relocation, preparing a disaster recovery plan (DRP), and conducting a business impact analysis (BIA) for an alternate location are all activities that can help to develop or implement a BCP, but they are not the best way to mitigate the risk to operations. References = Risk and Information Systems Control Study Manual, Chapter 5, Section 5.2.1, page 5-9.
Which of the following is the BEST way to address IT regulatory compliance risk?
Managing IT regulatory compliance risk in the same manner as other operational risks ensures a consistent and integrated approach to risk management. This involves identifying, assessing, mitigating, and monitoring compliance risks using the organization's established risk management framework. Such an approach promotes efficiency and ensures that compliance risks are not siloed but are considered within the broader context of enterprise risk management.
ISACA CRISC Review Manual, 7th Edition, Chapter 1: Governance, Section:Risk Governance.
External penetration tests MUST include:
Post your Comments and Discuss ISACA CRISC exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CRISC content, but please register or login to continue.