Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  2. Home
  3. Exams
  4. ISACA
  5. CRISC

ISACA CRISC Exam Questions
Certified in Risk and Information Systems Control (Page 70 )

Updated On: 28-Feb-2026
Page 70 of 380
PDF with 1895 Questions

During the initial risk identification process for a business application, it is MOST important to include which of the following stakeholders?

  1. Business process owners
  2. Business processconsumers
  3. Application architecture team
  4. Internal audit

Answer(s): A

Explanation:

The MOST important stakeholders to include during the initial risk identification process for a business application are the business process owners, because they are the ones who have the authority and responsibility for the business processes that are supported or enabled by the business application. The business process owners can provide valuable input and feedback on the business objectives, requirements, and expectations of the business application, as well as thepotential risks, impacts, and opportunities that may affect the business processes and outcomes. The other options are not as important as the business process owners, because:
Option B: Business process consumers are the ones who use or benefit from the business processes that are supported or enabled by the business application, such as customers, employees, or partners. They can provide useful information and perspectives on the user needs, preferences, and satisfaction of the business application, but they are not as important as the business process owners, who have the ultimate accountability and authority for the business processes and outcomes.
Option C: Application architecture team is the one who designs and develops the technical architecture and components of the business application, such as the hardware, software, network, and data. They can provide technical expertise and guidance on the feasibility, functionality, and security of the business application, but they are not as important as the business process owners, who have the primary stake and interest in the business application and its alignment with the business processes and objectives. Option D: Internal audit is the one who provides independent assurance and consulting services on the governance, risk management, and control processes of the organization, including the business application. They can provide objective and impartial evaluation and recommendation on the effectiveness and efficiency of the business application and its compliance with the internal and external standards and regulations, but they are not as important as the businessprocess owners, who have the direct involvement and influence on the business application and its performance and value. References = Risk and Information Systems Control Study Manual, 7th Edition, ISACA, 2020, p. 103.



A risk practitioner is summarizing the results of a high-profile risk assessment sponsored by senior management. The BEST way to support risk-based decisions by senior management would be to:

  1. map findings to objectives.
  2. provide quantified detailed analysis
  3. recommend risk tolerance thresholds.
  4. quantify key risk indicators (KRls).

Answer(s): A

Explanation:

The best way to support risk-based decisions by senior management would be to map findings to objectives, because this would help them understand how the identified risks affect theachievement of the organization's goals and priorities. Mapping findings to objectives would also help senior management evaluate the trade-offs between different risk responses and allocate resources accordingly. By linking risks to objectives, the risk practitioner can communicate the value and impact of risk management in a clear and relevant way. References = Risk IT Framework, ISACA, 2022, p. 17



An organization is measuring the effectiveness of its change management program to reduce the number of unplanned production changes.
Which of the following would be the BEST metric to determine if the program is performing as expected?

  1. Decrease in the time to move changes to production
  2. Ratio of emergency fixes to total changes
  3. Ratio of system changes to total changes
  4. Decrease in number of changes without a fallback plan

Answer(s): B

Explanation:

The ratio of emergency fixes to total changes is the best metric to determine if the change management program is performing as expected, because it reflects the quality and stability of the changes that are implemented in the production environment. A high ratio of emergency fixes to total changes indicates that the change management program is not effective, as it means that many changes are causing problems or failures that require urgent correction. A low ratio of emergency fixes to total changes indicates that the change management program is effective, as it means that most changes are well-planned, tested, and approved, and do not cause significant disruptions or defects. The ratio of emergency fixes to total changes can also help identify the root causes of the problems, the gaps in the change management process, and the areas for improvement. For example, if the ratio of emergency fixes to total changes is high, it may indicate that the change management program has issues with the following aspects: - Change request and approval: The change management program may not have a clear and consistent process for requesting, reviewing, and approving changes, or the process may not be followed by all stakeholders. - Change impact analysis:

The change management program may not have acomprehensive and systematic method for assessing the potential impact of the changes on thebusiness processes, the IT systems, the users, and the customers. - Change testing and validation: The change management program may not have adequate testing and validation procedures to ensure that the changes meet the requirements and specifications, and do not introduce errors or vulnerabilities. - Change communication and training: The change management program may not have effective communication and training strategies to inform and educate the affected parties about the changes and their implications. - Change implementation and monitoring: The change management program may not have proper implementation and monitoring plans or tools to ensure that the changes are executed smoothly and successfully, and that any issues or incidents are detected and resolved promptly. Therefore, the ratio of emergency fixes to total changes is the best metric to determine if the change management program is performing as expected, as it can provide valuable feedback and insights for the change management program and its improvement. References = How to Measure Change Management Effectiveness: Metrics, Tools & Processes1, Metrics for Measuring Change Management2, Driving Value with Change Management Metrics3, Must-Know Organizational Change Management Metrics



An organization is increasingly concerned about loss of sensitive data and asks the risk practitioner to assess the current risk level.
Which of the following should the risk practitioner do FIRST?

  1. Identify staff members who have access to the organization's sensitive data.
  2. Identify locations where the organization's sensitive data is stored.
  3. Identify risk scenarios and owners associated with possible data loss vectors.
  4. Identify existing data loss controls and their levels of effectiveness.

Answer(s): B

Explanation:

The first step in assessing the current risk level of data loss is to identify where the sensitive data is stored, such as servers, databases, laptops, mobile devices, etc. This will help to determine the scope and boundaries of the risk assessment, as well as the potential exposure and impact of data loss. Identifying staff members who have access to the data, risk scenarios and owners, and existing controls are important steps, but they should be done after identifying the data locations. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 2, Section 2.1.1.1, page 51.



Which of the following statements BEST describes risk appetite?

  1. The amount ofrisk an organization is willing to accept
  2. The effective management of risk and internal control environments
  3. Acceptable variation between risk thresholds and business objectives
  4. The acceptable variation relative to the achievement of objectives

Answer(s): A

Explanation:

Risk appetite is defined as "the amount of risk that an organization is willing to accept in pursuit of its objectives, before action is deemed necessary to reduce the risk."1 It represents a balance between the potential benefits of innovation and the threats that change inevitably brings. Risk appetite reflects the organization's risk attitude and its willingness to accept risk in specific scenarios, with a governance model in place for risk oversight. Risk appetite helps to guide the organization's approach to risk and risk management, and to align its risk decisions with its business objectives and context. The other options are not the best descriptions of risk appetite, as they are either too vague (the effective management of risk and internal control environments), too narrow (acceptable variation between risk thresholds and business objectives), or confusing (the acceptable variation relative to the achievement of objectives). References = Risk Appetite vs. Risk Tolerance: What is the Difference?



Viewing page 70 of 380
Viewing questions 346 - 350 out of 1895 questions



Post your Comments and Discuss ISACA CRISC exam dumps with other Community members:

CRISC Exam Discussions & Posts

AI Tutor