CRISC Exam Dumps - Certified in Risk and Information Systems Control

Risk culture is the foundation upon which ERM is built. It dictates how employees perceive, communicate, and act on risk. A strong risk culture ensures consistency in risk behaviors, supports governance, and sustains long-term effectiveness of the ERM.

Developing a risk response plan is the best action to address the risk scenarios with high impact and low likelihood of occurrence, because it helps to define and implement the appropriate actions to reduce or eliminate the risk, or to prepare for and recover from the potential consequences. A risk response plan is a document that outlines the strategies and tactics for managing the identified risks, such as avoiding, transferring, mitigating, or accepting the risk. A risk response plan also assigns the roles and responsibilities for the risk owners and stakeholders, and sets the timelines and budgets for the risk response activities. A risk scenario with high impact and low likelihood of occurrence is a rare but severe event that may cause significant disruption or damage to the organization or its objectives, such as a natural disaster, a cyberattack, or a pandemic. Therefore, developing a risk response plan is the best action to address these scenarios, as it helps to minimize the exposure and impact of the risk, and to enhance the resilience and recovery of the organization. Assembling an incident response team, creating a disaster recovery plan (DRP), and initiating a business impact analysis (BIA) are all important actions to perform as part of the risk response plan, but they are not the best action, as they do not cover the whole spectrum of risk response strategies and activities. References = Risk and Information Systems Control Study Manual, Chapter 3, Section 3.4.2, page 103

 The most important information to include when reporting the effectiveness of risk management to senior management is the changes in residual risk levels against acceptable levels, as it indicates how well the risk management process and activities have reduced the risk exposure and impact to the level that is aligned with the risk tolerance and appetite of the organization. The other options are not the most important information, as they are more related to thedrivers,factors, or outcomes of risk management, respectively, rather than the effectiveness or value of risk management. References = CRISC Review Manual, 7th Edition, page 109.

Automated asset management software is the best method to track asset inventory because it can provide real-time, accurate, and comprehensive data on the location, condition, value, and usage of assets. It can also help to optimize asset utilization, reduce costs, improve compliance, and enhance security.

References

•Free Asset Tracking Templates | Smartsheet

•5 Best Asset Management Software (2023) – Forbes Advisor

•What Is Asset Tracking? Benefits & How It Works - Forbes

•Inventory and Asset Tracking: Keep it Simple (But Powerful)

Reporting the activity to the supervisor is the first thing that the risk practitioner should do when learning that a risk owner has been accepting gifts from a supplier of IT products. This is because accepting gifts from a supplier of IT products can create a conflict of interest, compromise the integrity and objectivity of the risk owner, and violate the organizational ethics policies. Reporting the activity to the supervisor can help ensure that the issue is escalated to the appropriate authority, investigated, and resolved in a timely and transparent manner. According to the CRISC Review Manual 2022, one of the key risk response techniques is to report the risk to the relevant stakeholders, such as the supervisor1. According to the web search results, reporting the activity to the supervisor is a common and recommended action when encountering a potential ethical violation in the workplace

CRISC and privacy frameworks such as ISO/IEC 27701 and GDPR emphasizedata minimizationas the first step in managing privacy risk:

“Personal data collection must be limited to what is necessary for the specified purpose.”

If data is never collected, there’s no need for storage, encryption, or training around it — thus reducing exposure and risk at the source.

Other options, while useful, comeafterminimizing collection:

AandDaddress residual risk.

B(normalization) affects data structure, not privacy risk reduction.

Hence,C. Minimize the collection of datais correct.

CRISC Reference:Domain 3 – Risk Response and Mitigation, Topic: Privacy Risk Controls.