When documenting a risk response, which of the following provides the STRONGEST evidence to support the decision?
Answer(s): D
The strongest evidence to support a risk response decision is a memo indicating risk acceptance. A memo is a formal and written document that can clearly communicate the rationale, criteria, and approval of the risk acceptance decision. Verbal majority acceptance of risk by committee, list of compensating controls, and IT audit follow-up responses are weaker evidence, as they may not be documented, verified, or aligned with the risk response decision. References = ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, question 11; CRISC Review Manual, 6th Edition, page 144.
Which of the following would be MOST useful when measuring the progress of a risk response action plan?
A risk response action plan is a document that outlines the specific tasks, resources, timelines, and deliverables for the risk responses, which are the actions or strategies that are taken to address the risks that may affect the organization's objectives, performance, or value creation12.The most useful tool when measuring the progress of a risk response action plan is an up-to- date risk register, which is a document that records and tracks the significant risks that the organization faces, and the responses and actions that are taken to address them34. An up-to-date risk register is the most useful tool because it provides a comprehensive and consistent view of the risk landscape, and the status and performance of the risk responses and actions34.An up-to-date risk register is also the most useful tool because it enables the monitoring and evaluation of the risk response action plan, and the identification and communication of any issues or gaps that need to be resolved or improved34. The other options are not the most useful tools, but rather possible metrics or indicators that may be used to measure the progress of a risk response action plan. For example:Percentage of mitigated risk scenarios is a metric that measures the proportion of risk scenarios that have been reduced or eliminated by the risk responses and actions56. However, this metric is not the most useful tool because it does not provide a comprehensive and consistent view of the risk landscape, and it may not capture the residual or emerging risks that may arise after the risk responses and actions56. Annual loss expectancy (ALE) changes is a metric that measures the difference between the expected annual losses before and after the risk responses and actions78. However, this metric is not the most useful tool because it does not provide a comprehensive and consistent view of the risk landscape, and it may not reflect the qualitative or intangible impacts of the risks or the risk responses and actions78.Resource expenditure against budget is a metric that measures the amount of resources and funds that have been spent or allocated for the risk responses and actions, compared to the planned or estimated budget . However, this metric is not the most useful tool because it does not provide acomprehensive and consistent view of the risk landscape, and it may not indicate the effectiveness or efficiency of the risk responses and actions . References =1: Risk Response Plan in Project Management: Key Strategies & Tips12: How to Create the Ultimate Risk Response Plan | Wrike23: Risk Register Template and Examples | Prioritize and Manage Risk34: Risk Register Examples for Cybersecurity Leaders45: Risk Scenarios Toolkit, ISACA, 20196: Risk Scenarios Starter Pack, ISACA, 20197: Annualized Loss Expectancy (ALE) - Definition and Examples58: Annualized Loss Expectancy (ALE) Calculator6Project Budgeting: How to Estimate Costs and Manage Budgets7 Project Budget Template - Download Free Excel Template8
Who should be responsible for determining which stakeholders need to be involved in the development of a risk scenario?
Answer(s): B
The risk practitioner is responsible for determining which stakeholders need to be involved in the development of a risk scenario, as they have the knowledge and skills to facilitate the process and ensure that the relevant perspectives and information are considered. The risk owner, the compliance manager, and the control owner are examples of stakeholders who may participate in the risk scenario development, but they are not responsible for determining who should be involved. References = Risk Scenarios Toolkit, page 9; CRISCReview Manual, 7th Edition, page 101.
Which of the following has the GREATEST positive impact on ethical compliance within the risk management process?
Answer(s): A
According to the ISACA Risk IT Framework, one of the key principles for effective risk management is to establish tone at the top and accountability. This means that senior management should set an example of ethical behavior and culture, and communicate the importance of ethics and compliance to the entire organization. Senior management should also ensure that the risk management process is aligned with the organization's mission, vision, values, and code of conduct, and that ethical risks are identified, assessed, and treated appropriately. By demonstrating ethics in their day-to-day decision making, senior management can have the greatest positive impact on ethical compliance within the risk management process, as they can influence the attitudes, behaviors, and actions of all stakeholders.
·ISACA, Risk IT Framework, 2nd Edition, 2019, p. 741 ·ISACA, The Role of Ethics in Risk Management2
Of the following, who is accountable for ensuing the effectiveness of a control to mitigate risk?
The control owner is the person who is accountable for ensuring that a control is designed, implemented, and operated effectively to mitigate risk. The control owner is also responsible for monitoring the performance of the control and reporting any issues or deficiencies. The risk manager is the person who oversees the risk management process and ensures that risks are identified, assessed, and treated appropriately. The control operator is the person who executes the control activities on a day-to-day basis. The risk treatment owner is the person who is accountable for implementing the risk response strategy and ensuring that the residual risk is within the acceptable level. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 4, Section 4.2.1, p. 181.
Post your Comments and Discuss ISACA CRISC exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CRISC content, but please register or login to continue.