CRISC Exam Dumps - Certified in Risk and Information Systems Control

The most important factors to consider when evaluating a number of potential controls for treating risk are the residual risk and the cost of control. Residual risk is the risk that remains after the implementation of the controls. Cost of control is the amount of resources and efforts required to implement and maintain the controls. By considering the residual risk and the cost of control, the organization can optimize the balance between the risk exposure and the control investment, and choose the most effective and efficient controls. Risk appetite and control efficiency, inherent risk and control effectiveness, and risk tolerance and control complexity are other possible factors, but they are not as important as residual risk and cost of control. References = ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, question 8; CRISC Review Manual, 6th Edition, page 97.

Low-probability, high-impact events are those that have a low chance of occurring but would cause significant harm if they do. These events are often difficult to predict and quantify, but they can have a major impact on the organization’s objectives, reputation, or operations. By including these events in a risk assessment, the organization can develop understandable and realistic risk scenarios that reflect the potential consequences of different outcomes1. This can help the organization to prioritize its risk management activities and allocate its resources accordingly.

References = Risk and Information Systems Control Study Manual, Chapter 5: Risk Assessment Process

 Accepting residual risk is the most important responsibility of a risk owner, as it implies that the risk owner is accountable for the risk and its impact on the enterprise’s objectives and operations. Residual risk is the risk that remains after the implementation of controls, and it should be aligned with the risk appetite and tolerance of the enterprise. The risk owner is responsible for implementing the risk response strategies and monitoring the risk status and outcomes, as well as for reporting and escalating the risk issues and incidents. Testing control design, establishing business information criteria, and establishing the risk register are not the most important responsibilities of a risk owner, but rather the tasks or activities that the risk owner may performor delegate as part of the risk management process. References = CRISC Certified in Risk and Information Systems Control – Question218; ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, question 218.

According to the CRISC Review Manual1, the risk register is a tool that records the results of risk identification, analysis, evaluation, and treatment. It should be updated whenever there is a change in the risk profile, such as when a vulnerability is closed or a new threat is identified. Updating the risk register allows the organization to monitor the current status of risks and the effectiveness of risk responses. Therefore, the next course of action after implementing changes to close an identifiedvulnerability is to update the risk register with the new information. References = CRISC Review Manual1, page 191.

The risk owner holds ultimate accountability for risk treatment, as they are responsible for decisions regarding the management and mitigation of the risk. This is a fundamental principle ofRisk Ownership and Accountabilitywithin the CRISC framework.

The risk register element that is most likely to be updated if the attack surface or exposure of an asset is reduced is the likelihood rating, as this reflects the probability or frequency of a risk event occurring. The attack surface or exposure of an asset is the measure of the extent and accessibility of the asset to potential threats or attackers. If the attack surface or exposure of an asset is reduced, the likelihood of the asset being compromised or damaged by a risk event is also reduced. Therefore, the likelihood rating of the risk should be updated accordingly. Theother options are not the risk register elements that are most likely to be updated if the attack surface or exposure of an asset is reduced, although they may be affected or influenced by it. Control effectiveness is the measure of how well the risk controls reduce the risk level or achieve the control objectives. Assessment approach is the method or technique used to identify, analyze, and evaluate the risks. Impact rating is the measure of the magnitude or severity of the consequences of a risk event on the asset or the organization. References = Risk and Information Systems Control Study Manual, Chapter 2: IT Risk Identification, page 54.

According to the ISACA Risk and Information Systems Control study guide and handbook, the information owner is the official with statutory or operational authority for specified information and responsibility for establishing the controls for its generation, collection, processing, dissemination, and disposal. The information owner is also responsible for authorizing access to the information within their domain, based on the principle of least privilege and the need toknow. Therefore, the information owner should be accountable for authorizing information system access to internal users12

1: ISACA Risk and Information Systems Control Study Guide, 4th Edition, page 33 2: ISACA Risk and Information Systems Control Handbook, 1st Edition, page 25

The person who should be accountable for resolving the situation where a root cause analysis indicates a major service disruption due to a lack of competency of newly hired IT system administrators is the chief information officer (CIO). The CIO is the senior executive who is responsible for the overall management and governance of the IT function within the organization, including the IT strategy, objectives, policies, processes, and resources. The CIO is also accountable for the performance and value of the IT services and systems, and for ensuring that they meet the needs and expectations of the business and its stakeholders. The CIO should be accountable for resolving the situation, because it involves a major IT service disruption that could affect the organization’s operations and reputation, and because it is related to the IT staff competency and capability, which are under the CIO’s authority and responsibility. The other options are not as accountable as the CIO, although they may have some roles or involvement inthe situation. The HR training director, the business process owner, and the HR recruitment manager are not directly responsible for the IT function or the IT service delivery, and they may not have the authority or the expertise to resolve the situation. References = Risk and Information Systems Control Study Manual, Chapter 2, Section 2.1.1, page 2-3.