Concerned about system load capabilities during the month-end close process, management requires monitoring of the average time to complete tasks and monthly reporting of the findings. What type of measure has been established?
Answer(s): D
Monitoring the average time to complete tasks and monthly reporting of the findings during the month-end close process aligns with the definition of a Key Performance Indicator (KPI).Understanding KPIs:Performance Measurement:KPIs are used to measure how effectively a company is achieving its key business objectives. Monitoring the average time to complete tasks during the month- end close process provides a performance metric.Tracking Efficiency:By reporting these findings monthly, management can track the efficiency and performance of the system load capabilities.Specific Measure:Task Completion Time:The average time to complete tasks is a specific, measurable indicator of performance. It helps in understanding how well the system handles load and identifies areas for improvement.Continuous Improvement:Regular monitoring and reporting encourage continuous improvement, which is a core aspect of using KPIs.
According to ISACA's guidelines on performance measurement, KPIs are critical for tracking the efficiency and effectiveness of processes and systems. They provide tangible metrics that help in decision-making and performance improvement.
Which of the following would be a risk practitioner's BEST recommendation upon learning of an updated cybersecurity regulation that could impact the organization?
Answer(s): A
Performing a gap analysis is the best recommendation for a risk practitioner upon learning of an updated cybersecurity regulation that could impact the organization. A gap analysis can help identify the current state of compliance, the desired state of compliance, and the actions needed to achieve compliance. Conducting system testing, implementing compensating controls, and updating security policies are possible actions that may result from the gap analysis, but they arenot the best initial recommendation. References = ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, question 1; CRISC Review Manual, 6th Edition, page 143.
Which of the following should be of GREATEST concern to a risk practitioner when determining the effectiveness of IT controls?
Configuration updates are changes made to the settings, parameters, or components of an IT system or network. Configuration updates can affect the functionality, performance, security, and reliability of the system or network. Therefore, configuration updates should follow formal change control, which is a process that ensures that changes are authorized, documented, tested, and implemented in a controlled manner. Formal change control can help prevent errors, conflicts, disruptions, and vulnerabilities that may arise from configuration updates. Configuration updates that do not follow formal change control should be of greatest concern to a risk practitioner when determining the effectiveness of IT controls, as they can introduce newrisks or compromise existing controls. References = Risk and Information Systems Control Study Manual, Chapter 3: Risk Response and Mitigation, Section 3.5: Control Monitoring and Reporting, p. 161-162.
Which of the following would present the GREATEST challenge when assigning accountability for control ownership?
Control ownership is the assignment of roles and responsibilities for the design, implementation, monitoring, and improvement of controls that mitigate risks. Control ownership can help ensure that the controls are effective, efficient, and aligned with the business objectives and risk appetite. Control ownership can also help facilitate the communication, coordination, and accountability among the stakeholders involved in the risk management process. One of the factors that would present the greatest challenge when assigning accountability for control ownership is unclear reporting relationships. Reporting relationships are the formal or informal lines of authority and communication that define who reports to whom, and who is accountable for what. Unclear reporting relationships can create confusion, ambiguity, and conflict among the control owners and other stakeholders, such as the risk owners, the business owners, the auditors, the regulators, etc. Unclear reporting relationships can also hinder the performance evaluation, feedback, and recognition of the control owners, and affect their motivation and commitment. Unclear reporting relationships can also increase the risk of duplication, inconsistency, or gaps in the control activities, and compromise the quality and reliability of the control environment. References = Defining, Assigning and Measuring: Accountability Challenges in 21st Century Governance, CRISC 351-400 topic3, Foundations of Project Management :Week 2.
What is the GREATEST concern with maintaining decentralized risk registers instead of a consolidated risk register?
A risk register is a tool that records and tracks the identified risks, their causes, impacts,likelihood, responses, and owners. A decentralized risk register is maintained by each business unit or function, while a consolidated risk register is maintained at the enterprise level. The greatest concern with maintainingdecentralized risk registers instead of a consolidated risk register is that the aggregated risk may exceed the enterprise's risk appetite and tolerance. Risk appetite is the amount and type of risk that an enterprise is willing to accept in pursuit of its objectives, while risk tolerance is the acceptable level of variation around the objectives. If the risk registers are not consolidated, the enterprise may not have a holistic view of its risk profile and may not be able to prioritize and allocate resources effectively. The other options are also concerns, but they are not as significant as the potential misalignment between the aggregated risk and the enterprise's risk appetite and tolerance. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 1, Section 1.2.2.2, pp. 21-22.
Post your Comments and Discuss ISACA CRISC exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CRISC content, but please register or login to continue.