CRISC Exam Dumps - Certified in Risk and Information Systems Control

 Accepting residual risk is the most important responsibility of a risk owner, as it implies that the risk owner is accountable for the risk and its impact on the enterprise’s objectives and operations. Residual risk is the risk that remains after the implementation of controls, and it should be aligned with the risk appetite and tolerance of the enterprise. The risk owner is responsible for implementing the risk response strategies and monitoring the risk status and outcomes, as well as for reporting and escalating the risk issues and incidents. Testing control design, establishing business information criteria, and establishing the risk register are not the most important responsibilities of a risk owner, but rather the tasks or activities that the risk owner may performor delegate as part of the risk management process. References = CRISC Certified in Risk and Information Systems Control – Question218; ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, question 218.

A risk register is a document that records and tracks the information and status of the identified risks and their responses. It includes the risk description, category, source, cause, impact, probability, priority, response, owner, action plan, status, etc.

Periodically reviewing and updating a risk register with details on identified risk factors primarily helps to provide a current reference to stakeholders for risk-based decisions, which are the decisions that are made based on the consideration and evaluation of the risks and their responses. Providing a current reference to stakeholders for risk-based decisions helps to ensure that the decisions are consistent, appropriate, and proportional to the level and nature of the risks, and that they support the organization’s objectives and values. It also helps to optimize the balance between risk and return, and to create and protect value for the organization and its stakeholders.

The other options are not the primary benefits of periodically reviewing and updating a risk register with details on identified risk factors, because they do not address the main purpose and benefit of a risk register, which is to provide a current reference to stakeholders for risk-based decisions.

Minimizing the number of risk scenarios for risk assessment means reducing the scope and depth of risk analysis and reporting, and impairing the organization’s ability to identify and respond to emerging or changing risks. Periodically reviewing and updating a risk register with details onidentified risk factors does not necessarily minimize the number of risk scenarios for risk assessment, and it may not be a desirable or beneficial outcome for the organization.

Aggregating risk scenarios identified across different business units means combining or consolidating the risks that are identified by different parts or functions of the organization, and creating a holistic or integrated view of the organization’s risk profile. Periodically reviewing and updating a risk register with details on identified risk factors does not necessarily aggregate risk scenarios identified across different business units, and it may not be a sufficient or effective way to achieve a holistic or integrated view of the organization’s risk profile.

Building a threat profile of the organization for management review means creating or developing a summary or representation of the potential threats or sources of harm that may affect the organization’s objectives and operations, and presenting or reporting it to the senior management for their awareness and approval. Periodically reviewing and updating a risk register with details on identified risk factors does not necessarily build a threat profile of the organization for management review, and it may not be a comprehensive or reliable way to create or develop a summary or representation of the potential threats or sources of harm that may affect the organization. References =

ISACA, CRISC Review Manual, 7th Edition, 2022, pp. 19-20, 23-24, 27-28, 31-32, 40-41, 47-48, 54-55, 58-59, 62-63

ISACA, CRISC Review Questions, Answers & Explanations Database, 2022, QID 172

CRISC Practice Quiz and Exam Prep

Obtaining a holistic view of IT strategy risk is the primary benefit of conducting a risk workshop using a top-down approach instead of a bottom-up approach, because it helps to identify and assess the risks that may affect the alignment and integration of IT with the organization’s objectives and strategy. A risk workshop is a collaborative and interactive method of conducting a risk assessment, where the risk practitioner facilitates a group discussion with the relevant stakeholders to identify, analyze, and evaluate the risks and their controls. A top-down approach is a method of conducting a risk workshop that starts from the high-level or strategic perspective, and then drills down to the lower-level or operational details. A bottom-up approach is a methodof conducting a risk workshop that starts from the low-level or operational details, and then aggregates them to the higher-level or strategic perspective. A top-down approach can offer a holistic view of IT strategy risk, as it helps to understand the big picture and the interrelationships of the risks and their impacts across the organization. A bottom-up approach can offer a detailed view of specific project or process risk, as it helps to capture the granular and technical aspects of the risks and their controls. Therefore, obtaining a holistic view of IT strategy risk is the primary benefit of using a top-down approach, as it supports the strategic alignment and integration of IT with the organization. Identifying specific project risk, understanding risk associated with complex processes, and incorporating subject matter expertise are all possible benefits of conducting a risk workshop, but they are not the primary benefit of using a top-down approach, as they are more suitable for a bottom-up approach. References = Risk and Information Systems Control Study Manual, Chapter 3, Section 3.2.2, page 87

The operational risk associated with attacks on a web application should be owned by the individual in charge of the business function, because they are the primary stakeholder and beneficiary of the web application, and they are responsible for defining and achieving the business objectives and requirements that the web application supports or enables. Anoperational risk is a risk of loss or damage resulting from inadequate or failed internal processes, people, or systems, or from external events. An attack on a web application is a type of operational risk that involves a malicious or unauthorized attempt to compromise the confidentiality, integrity, or availability of the web application, such as a denial-of-service attack, a SQL injection attack, or a cross-site scripting attack. A web application is an application that runs on a web server and can be accessed or used through a web browser, such as an online shopping site, a social media platform, or a web-based email service. A business function is a set of activities or tasks that support or enable the organization’s vision, mission, and strategy, such as marketing, sales, or customer service. A risk owner is a person or role that has the authority and accountability to manage a specific risk, and to implement and monitor the risk response and controls. The individual in charge of the business function should be the risk owner, as they have the best understanding and interest of the web application and its business value and impact, and they have the ability and responsibility to manage the operational risk associated with the attacks on the web application. The individual in charge of network operations, the cybersecurity function, or application development are all possible candidates for the risk owner, but they are not the best choice, as they may not have the same level of stake and influence in the web application and its business objectives and requirements, and they may have different orconflicting priorities or perspectives on the operational risk and its management. References = Risk and Information Systems Control Study Manual, Chapter 3, Section 3.4.1, page 101

The best indicator of an effective IT security awareness program is the decreased success rate of internal phishing tests. Phishing is a type of social engineering attack that attempts to trick the users into revealing their personal or confidential information, or clicking on malicious links or attachments, by impersonating a legitimate entity or person. Internal phishing tests are simulated phishing attacks that are conducted by the enterprise to test the awareness and behavior of the employees in response to phishing emails. A decreased success rate of internal phishing tests means that fewer employees fall victim to the phishing attempts, and that they are more aware and vigilant of the phishing threats and techniques. A decreased success rate of internal phishing tests also implies that the IT security awareness program has effectively educated and trained the employees on how to recognize and report phishing emails, and how to protect themselves and the enterprise from phishing attacks. A decreased number of reported security incidents, a number of disciplinary actions issued for security violations, and a number of employees that complete security training are not as good indicators of an effective IT security awareness program as a decreased success rate of internal phishing tests, as they do not directly measure theawareness and behavior of the employees in relation to phishing, and may be influenced by otherfactors such as reporting mechanisms, enforcement policies, and training availability. References = CRISC Review Manual, 6th Edition, ISACA, 2015, page 220.

A legacy system is an old or outdated IT system that is still in use by an organization. A legacy system may pose various risks to the organization, such as security vulnerabilities, compatibility issues, performance degradation, maintenance challenges, etc. When an internal audit report reveals that a legacy system is no longer supported by the vendor or the manufacturer, the risk practitioner’s most important action before recommending a risk response is to assess the potential impact and cost of mitigation, which means to estimate the consequences and expenses of the risk event if the legacy system fails or malfunctions. By assessing the potential impact andcost of mitigation, the risk practitioner can evaluate the risk exposure and determine the appropriate risk response, such as accepting, avoiding, transferring, or reducing the risk. References = 4

ï‚· Understanding the Question:

The question seeks to identify which source provides the most useful information for evaluating the effectiveness of existing controls.

ï‚· Analyzing the Options:

A. Previous audit reports:Provide historical data but might not reflect current risks.

B. Control objectives:These are standards to be achieved, not current evaluations.

C. Risk responses in the risk register:Useful but focused on specific responses rather than overall effectiveness.

D. Changes in risk profiles:Reflect current and emerging risks, providing a dynamic view of control effectiveness.

ï‚·

Risk Profiles:Evaluating changes in risk profiles helps understand how effective existing controls are against current threats. If risk levels are increasing, it may indicate that controls are insufficient or need updating.

Proactive Adjustment:By monitoring changes in risk profiles, organizations can proactively adjust their controls to address new or evolving risks.