Several network user accounts were recently created without the required management approvals. Which of the following would be the risk practitioner's BEST recommendation to address this situation?
Answer(s): C
Several network user accounts were recently created without the required management approvals. This indicates that there is a risk of unauthorized access, use, disclosure, modification, or destruction of the network resources or data, which may affect the confidentiality, integrity, and availability of the network. The best recommendation to address this situation is to investigate the root cause of noncompliance. This means that the risk practitioner should analyze the factors or reasons that led to the creation of the network user accounts without the required management approvals, such as human error, negligence, malice, system failure, process flaw, etc.Investigating the root cause of noncompliance helps to identify and correct the source of the problem, prevent or reduce the recurrence of the problem, and improve the compliance and security of the network user accounts.The other options are not the best recommendations to address this situation. They are either secondary or not effective for noncompliance.The references for this answer are:Risk IT Framework, page 31Information Technology & Security, page 25Risk Scenarios Starter Pack, page 23
An application development team has a backlog of user requirements for a new system that will process insurance claim payments for customers. Which of the following should be the MOST important consideration for a risk-based review of the user requirements?
According to the CRISC Review Manual, one of the key objectives of risk identification is to assess the potential impact of risk events on the achievement of business objectives2. In this case, the business objective of the system is to process insurance claim payments for customers, which depends on the accuracy of claim calculation. Therefore, the impact to the accuracy ofclaim calculation should be the most important consideration for a risk-based review of the user requirements. The other options are less relevant or less critical for the business objective.
Which of the following BEST confirms the existence and operating effectiveness of information systems controls?
Answer(s): D
First-hand direct observation of the controls in operation is the best way to confirm the existence and operating effectiveness of information systems controls because it provides the auditor with the most reliable and persuasive evidence. Direct observation involves inspecting the physicaland logical aspects of the controls, such as the hardware, software, network, data, procedures, and personnel involved in the information systems. Direct observation also allows the auditor to verify that the controls are functioning as intended, and to identify any deviations or weaknesses that may affect the reliability of the information systems. Direct observation can be performed by using various techniques, such as walkthroughs, inquiries, inspections, reperformance, and analytical procedures1. References = Auditing Standard No. 13, The Auditor's Responses to the Risks of Material Misstatement, PCAOB, 20101
Which of the following trends would cause the GREATEST concern regarding the effectiveness of an organization's user access control processes? An increase in the:
The average time between user transfers and access updates is a trend that would cause the greatest concern regarding the effectiveness of an organization's user access control processes, as it indicates thedelay or inefficiency in updating the user access rights and privileges according to the user's current role and responsibilities. This can result in unauthorized or excessive access to the organization's information assets, and increase the risk of data leakage, fraud, or misuse. The user access control processes should ensure that the user access rights and privileges are reviewed and modified regularly, and especially when the user's role or status changes, such as transfer, promotion, demotion, or termination. References = ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, Question241. CRISC: Certified in Risk & Information Systems Control Sample Questions, Question 241. CRISC Sample Questions2024, Question 241.
Which of the following is the MOST important component in a risk treatment plan?
A risk treatment plan is a document that outlines the approach and actions to be taken to address the unacceptable risks identified in the risk assessment process1. A risk treatment plan should include the following components2:The risk identification number and descriptionThe risk treatment option chosen (e.g., avoid, reduce, share, or accept) The risk treatment owner, who is responsible for implementing and monitoring the risk treatmentThe risk treatment actions, which are the specific tasks or steps to be performed to execute the risk treatmentThe risk treatment resources, which are the human, financial, or technical resources required to support the risk treatmentThe risk treatment target date, which is the deadline for completing the risk treatment The risk treatment performance indicators, which are the measures to evaluate the effectiveness and efficiency of the risk treatment The risk treatment status, which is the current progress or outcome of the risk treatment Among the four options given, the most important component in a risk treatment plan is the treatment plan ownership. This is because the treatment plan ownership defines theaccountability and authority for the risk treatment, and ensures that the risk treatment actions are carried out as planned and reported as required3. The treatment plan ownership also facilitates the communication and coordination among the stakeholders involved in the risk treatment, and enables the escalation and resolution of any issues or challenges that may arise during the risk treatment process4.References = Risk Treatment (With Examples), ISO 27001 Risk Assessment & Risk Treatment: The Complete Guide, Risk Management Framework - Treat Risks, Risk Management Plan Components
Post your Comments and Discuss ISACA CRISC exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CRISC content, but please register or login to continue.