CRISC Exam Dumps - Certified in Risk and Information Systems Control

“Percentage of mitigated risk scenarios is a metric that measures the proportion of risk scenarios that have been reduced or eliminated by the risk responses and actions. However, this metric is not the most useful tool because it does not provide a comprehensive and consistent view of the risk landscape…”

To truly measure progress,an up‑to‑date risk registerprovides the full context and current status of risk treatments—capturing what’s been done and what remains.

===========

IT control self-assessments are techniques that involve identifying and evaluating the effectiveness and efficiency of the IT controls that are designed and implemented to mitigate the IT risks, by the managers and staff within the organization12.

An ineffective control is a control that does not achieve its intended objective or purpose, or does not operate as designed or expected34.

A low residual risk scenario is a situation or occurrence that has a low likelihood and impact of affecting the organization’s objectives, performance, or value creation, after considering the existing controls and their effectiveness56.

The next course of action when reviewing management’s IT control self-assessments and noting an ineffective control that links to several low residual risk scenarios is to recommend management accept the low-risk scenarios, which is a risk response strategy that involves acknowledging and tolerating the level of risk exposure, and not taking any further action to reduce or eliminate it78.

Recommending management accept the low-risk scenarios is the next course of action because it is the most cost-effective and reasonable option, given that the level of risk exposure is low andacceptable, and the cost and effort of implementing or improving the control may outweigh the potential benefits or value78.

Recommending management accept the low-risk scenarios is also the next course of action because it is consistent with the risk management process and objectives, which are to identifyand address the risks that may affect the achievement of the organization’s goals and the delivery of value to the stakeholders, and to optimize the balance between risk and reward78.

The other options are not the next course of action, but rather possible alternatives or steps that may be considered or followed in different circumstances or scenarios. For example:

Assessing management’s risk tolerance is a step that involves determining and communicating the acceptable or tolerable level of risk exposure for the organization or its business units, based on the organization’s risk appetite, criteria, and objectives78. However, this stepis not the next course of action because it is usually done before or during the risk assessment process, and not after noting an ineffective control that links to several low residual risk scenarios78.

Proposing mitigating controls is a course of action that involves suggesting or recommending additional or alternative controls that can reduce or eliminate the level of risk exposure, and improve the effectiveness and efficiency of the risk management process78. However, this course of action is not the next course of action because it is not necessary or appropriate for low residual risk scenarios, as the cost and effort of implementing or improving the controls may outweigh the potential benefits or value78.

Re-evaluating the risk scenarios associated with the control is a course of action that involves revising and updating the likelihood and impact of the risk scenarios, and the level of risk exposure or tolerance for the organization, based on the current or changed conditions or factors that influence the risk landscape78. However, this course of action is not the next course of action because it is not required or relevant for low residual risk scenarios, as the level of risk exposure is already low and acceptable, and the ineffective control does not significantly affect the risk assessment78. References =

1: Control Self Assessments - PwC1

2: Control self-assessment - Wikipedia2

3: Ineffective Controls: What They Are and How to Identify Them3

4: Ineffective Controls: What They Are and How to Identify Them4

5: Residual Risk - Definition and Examples5

6: Residual Risk: Definition, Formula & Management6

7: Risk IT Framework, ISACA, 2009

8: IT Risk Management Framework, University of Toronto, 2017

According to the What To Look For When Assessing Your Organization’s Security Risk Posture article, risk appetite is the amount and type of risk that an organization is willing to accept in pursuit of its objectives. Risk appetite should be aligned with the organization’s strategy, goals, and values, and should reflect the organization’s risk culture and capabilities. When reviewing a risk response strategy, senior management’s primary focus should be placed on the alignment with risk appetite, as this indicates how well the risk response strategy supports the organization’s objectives and expectations, and how consistent it is with the organization’s risk tolerance and risk profile. By ensuring the alignment with risk appetite, senior managementcan evaluate the effectiveness and efficiency of the risk response strategy, and determine if any adjustments or improvements are needed. References = What To Look For When Assessing Your Organization’s Security Risk Posture

 The best course of action for the risk practitioner who has identified that the agreed RTO with a SaaS provider is longer than the business expectation is to document the gap in the risk register and report to senior management. The risk register is the document that records the details of all identified risks, including their sources, causes, impacts, likelihood, and responses. The risk register should be updated regularly to reflect any changes in the risk environment or the risk status. Reporting to senior management is also important, because senior management is the highest level of authority and responsibility in the organization, and they are responsible for setting the strategic direction, objectives, and risk appetite of the organization. Senior management should also oversee the risk management process, and ensure that the risks are aligned with the organization’s goals and values. By documenting the gap in the risk register and reporting to senior management, the risk practitioner can communicate the issue clearly and effectively, and seek guidance and support for resolving the problem. Collaborating with the risk owner, including a right to audit clause, or advising the risk owner to accept the risk are not the best courses of action, because they may not be feasible, effective, or desirable in some situations, or they may require senior management approval or involvement. References = Risk and Information Systems Control Study Manual, Chapter 4, Section 4.2.1, page 4-13.

Conducting a root cause analysis is the best course of action for an IT business owner following an unexpected increase in emergency changes, as it helps to identify and address the underlying cause(s) of the problem and prevent it from recurring in the future. A root cause analysis is a systematic process of finding and resolving the fundamental factors that contribute to a specific issue or event. A root cause analysis can help to improve the quality and reliability of the IT services and processes, reduce the costs and risks associated with emergency changes, and enhance the customer satisfaction and trust.

The other options are not the best courses of action for an IT business owner following an unexpected increase in emergency changes. Evaluating the impact to control objectives is an important step to assess the potential consequences of the emergency changes on the IT governance and risk management, but it does not provide a solution or mitigation strategy for the problem. Validating the adequacy of current processes is a good practice to ensure that the IT processes are aligned with the business needs and objectives, but it does not address the specific cause(s) of the emergency changes. Reconfiguring the IT infrastructure is a possible action to implement the emergency changes, but it does not prevent the occurrence or recurrence of the problem. References = IT Business Owner’s Best Course of Action Following Unexpected Increase …, ITIL Change Types: Standard vs Normal vs Emergency - Freshworks, Emergency Change Management: Please Stop The Drama

The most appropriate action when a tolerance threshold is exceeded is to communicate the potential impact to the decision makers. A tolerance threshold is the acceptable level of variation or deviation from the expected or planned performance or outcome of a risk response. When a tolerance threshold is exceeded, it means that the risk response is not effective or efficient enough to reduce the risk to an acceptable level, and that the enterprise is exposed to unacceptable levels of risk that could impair its ability to achieve its objectives. Therefore, the potential impact of the risk should be communicated to the decision makers, such as senior management, risk owners, or risk committee, who have the authority and responsibility to decide on the appropriate actions to address the risk situation. Communicating the potential impact can help to raise the awareness and urgency of the risk issue, and to facilitate the risk-based decision making process. Researching the root cause of similar incidents, verifying the response plan isadequate, and increasing human resources to respond in the interim are not as appropriate as communicating the potential impact, as they do not address the primary need of informing and involving the decision makers, and may not be feasible or effective in resolving the risk issue. References = CRISC Review Manual, 6th Edition, ISACA, 2015, page 41.