CRISC Exam Dumps - Certified in Risk and Information Systems Control

The business owner should own the risk if the ERP and payroll system fail to operate as expected, because the business owner is ultimately responsible for the business processes and objectives that depend on the systems. The other options are not the risk owners, because:

Option B: The ERP administrator is responsible for the technical aspects of the ERP system, but not the payroll system or the business outcomes.

Option C: The project steering committee is responsible for overseeing the project of replacing the ERP system, but not the ongoing operation and maintenance of the systems or the business risks.

Option D: The IT project manager is responsible for managing the project of replacing the ERP system, but not the payroll system or the business risks. References = Risk and Information Systems Control Study Manual, 7th Edition, ISACA, 2020, p. 90.

The greatest concern for a risk practitioner reviewing current key risk indicators (KRIs) is that the KRIs’ source data lacks integrity, as this means that the data is inaccurate, incomplete, inconsistent, or outdated, and therefore cannot provide reliable and valid information on the risk level and performance. The KRIs are metrics that measure and monitor the changes in the risk exposure and the effectiveness of the risk response over time. The KRIs’ source data should be collected and verified from credible and relevant sources, and should be updated and maintained regularly. The KRIs’ source data should also be aligned and integrated with the enterprise’s data governance and quality standards. The other options are not the greatest concerns for a risk practitioner reviewing current key risk indicators (KRIs), although they may pose some challenges or limitations. The KRIs are not automated is a concern for the efficiency and timeliness of the KRI reporting and analysis, but it does not affect the integrity of the KRI sourcedata. The KRIs are not quantitative is a concern for the objectivity and comparability of the KRI measurement and prioritization, but it does not affect the integrity of the KRI source data. The KRIs do not allow for trend analysis is a concern for the usefulness and relevance of the KRI communication and decision making, but it does not affect the integrity of the KRI source data. References = Risk and Information Systems Control Study Manual, Chapter 5: Risk and Control Monitoring and Reporting, page 183.

After entering a large number of low-risk scenarios into the risk register, it is most important for the risk practitioner to analyze changes to aggregate risk. Aggregate risk is the total amount and type of risk that the organization faces or accepts, considering all the individual and interrelated risk scenarios. Aggregate risk helps to measure and monitor the organization’s risk profile, riskappetite, and risk performance, and to support the risk decision-making and reporting processes. Analyzing changes to aggregate risk is important after entering a large number of low-risk scenarios, because even though the individual risk scenarios may have low likelihood or impact, they may still have a significant cumulative or combined effect on the organization’s objectives or operations. Analyzing changes to aggregate risk also helps to identify and prioritize the most critical or relevant risk scenarios, and to select the most appropriate and effective risk responses and strategies. The other options are not as important as analyzing changes to aggregate risk, although they may be part of or derived from the risk analysis process. Preparing a follow-up risk assessment, recommending acceptance of the risk scenarios, and reconfirming risk tolerance levels are all activities that can help to implement or update the risk management process, but they are not the most important after entering a large number of low-risk scenarios. References = Risk and Information Systems Control Study Manual, Chapter 4, Section 4.3.1, page 4-25.

The most effective approach to prioritize risk scenarios is by assessing the impact to the strategic plan, because this will help to align the risk management process with the organization’s vision, mission, and goals. The strategic plan is the document that defines the organization’s direction, priorities, and objectives, and guides the allocation of resources and efforts. By assessing theimpact to the strategic plan, the organization can determine which risk scenarios pose the greatest threat or opportunity to the achievement of the strategic objectives, and prioritize them accordingly. The other options are not as effective as assessing the impact to the strategic plan, because they do not directly relate to the organization’s specific context, needs, and expectations, as explained below:

B. Aligning with industry best practices is an approach that involves following the standards, norms, and expectations for risk management that are established and followed by the peers or competitors in the same industry or sector. Aligning with industry best practices can help to benchmark and compare the organization’s risk management performance and maturity, and identify areas for improvement or innovation. However, this approach is not as effective as assessing the impact to the strategic plan, because it does not account for the organization’s unique and customized risk scenarios, which may differ from the industry average or standard.

C. Soliciting input from risk management experts is an approach that involves seeking advice, guidance, or feedback from the professionals or specialists who have the knowledge, experience, or skills in risk management. Soliciting input from risk management experts can help to enhance the quality and validity of the risk analysis and evaluation, and provide insights and recommendations for risk mitigation. However, this approach is not as effective as assessing the impact to the strategic plan, because it does not reflect the organization’s risk appetite, preferences, and expectations, which may differ from the risk management experts’ opinions or perspectives.

D. Evaluating the cost of risk response is an approach that involves estimating the resources and efforts required to implement the risk response strategies, such as avoiding, reducing, transferring, or accepting the risk. Evaluating the cost of risk response can help to optimize the risk management efficiency and effectiveness, and balance the potential benefits and costs of taking risks. However, this approach is not as effective as assessing the impact to the strategic plan, because it does not consider the potential consequences and outcomes of the risk scenarios, which may affect the organization’s performance and reputation. References = Risk and Information Systems Control Study Manual, Chapter 2, Section 2.3.1, page 45. The Ultimate Guide to Risk Prioritization - Hyperproof, Risk Prioritization: What Is It? [2021 Guide & Matrix] - ERM Software, What is Risk Prioritization | Centraleyes, Scenario Planning in Risk Management: Why It is Needed - SmartCompliance

Senior management’s primary consideration in selecting risk response strategies is alignment with the organization’s risk appetite, ensuring that responses are consistent with the levels of risk the organization is willing to accept. While BIA results, KRIs, and investment portfolios inform decisions, risk appetite provides the guiding framework for prioritization and decision-making

The control evaluation phase of a risk assessment is the phase where the risk practitioner evaluates the effectiveness and efficiency of the existing or planned controls that mitigate the identified risks. Controls are the actions or measures that reduce the likelihood or impact of the risks to an acceptable level. The control evaluation phase involves testing, reviewing, and auditing the controls, and identifying any gaps or weaknesses that need to be addressed. If the control evaluation phase reveals that multiple controls are ineffective, the risk practitioner’s first course of action should be to determine the root cause of the control failures. The root cause is the underlying or fundamental reason that leads to the problem or issue, such as the controlfailure. By determining the root cause of the control failures, the risk practitioner can understand why the controls are not working as intended, and what factors or variables are influencing the control performance. This will help the risk practitioner to identify and implement the most appropriate and effective risk response strategy and actions, such as recommending risk remediation, comparing the residual risk, or escalating the control failures. The other options are not the first course of action, as they involve different steps or outcomes of the risk management process:

Recommend risk remediation of the ineffective controls means that the risk practitioner suggests the actions or measures that can improve or restore the effectiveness of the controls, such as by modifying, replacing, or adding the controls. This may be a useful step in the risk management process, but it is not the first course of action, as it may not address the root cause of the control failures, or may not be feasible or efficient for the enterprise’s needs.

Compare the residual risk to the current risk appetite means that the risk practitioner evaluates the level of risk that remains after considering the existing or planned controls, and compares it with the amount and type of risk that the enterprise is willing to accept in pursuit of its objectives. This may be a helpful step in the risk management process, but it is not the first course of action, as it may not reflect the true or current level of risk exposure, or may not account for the uncertainties or complexities of the risks or the controls.

Escalate the control failures to senior management means that the risk practitioner communicates the control failures to the senior leaders of the enterprise, who oversee the enterprise-wide risk management program, and provide guidance and direction to the risk owners and practitioners. This may be a necessary step in the risk management process, but it is not the first course of action, as it may not provide sufficient or timely information or action to address the control failures, or may not reflect the urgency or priority of the control failures. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 2, Section 2.3.3.1, pp. 62-63.

Implementing mock phishing exercises is the most effective way to validate organizational awareness of cybersecurity risk, because it helps to measure and test the knowledge and behavior of the employees regarding the detection and prevention of phishing attacks, which are one of the most common and dangerous forms of cybersecurity risk. A phishing attack is a fraudulent attempt to obtain sensitive or confidential information, such as usernames, passwords, or credit card details, by impersonating a legitimate or trusted entity, such as a bank, a government agency, or a colleague, through email, phone, or other communication channels. A mock phishing exercise is a simulated phishing attack that is conducted by the organization or a thirdparty to assess the level of awareness and readiness of the employees to recognize and respond to phishing attacks, and to provide feedback and training to improve their skills andknowledge. Implementing mock phishing exercises is the most effective way, as it helps to validate the actual and practical awareness of cybersecurity risk, and to identify and address the gaps or weaknesses in the employees’ awareness and behavior. Conducting security awareness training, updating the information security policy, and requiring two-factor authentication are all useful ways to enhance organizational awareness of cybersecurity risk, but they are not the most effective way, as they do not directly validate the awareness and behavior of the employees regarding phishing attacks. References = Risk and Information Systems Control Study Manual, Chapter 4, Section 4.3.2, page 158

 According to the IT Risk Management - Basics and Best Practices article, one of the best practices for IT risk management is to keep the risk register up to date. A risk register is a document that records the identified risks, their causes, impacts, likelihood, responses, andstatus. A risk register is a vital tool for IT risk management, as it helps to track and monitor the risks throughout their lifecycle, and to communicate the risks to the relevant stakeholders. However, a risk register is only useful if it reflects the current situation and environment of the organization. Therefore, the risk register should be regularly updated to capture any changes in the risk profile, such as new risks, resolved risks, modified risks, or escalated risks. Updating the risk register will help to ensure that the risk management process is effective and efficient, and that the risk responses are appropriate and timely. References = IT Risk Management - Basics and Best Practices