Free ISACA CRISC Practice Exams - Page 14 of 73

Question #131

Which of the following is a KEY consideration for a risk practitioner to communicate to senior management evaluating the introduction of artificial intelligence (Al) solutions into the organization?

A . Al requires entirely new risk management processes.
B . Al potentially introduces new types of risk.
C . Al will result in changes to business processes.
D . Third-party Al solutions increase regulatory obligations.

Reveal Solution Hide Solution

Question #132

To communicate the risk associated with IT in business terms, which of the following MUST be defined?

A . Compliance objectives
B . Risk appetite of the organization
C . Organizational objectives
D . Inherent and residual risk

Reveal Solution Hide Solution

Question #133

A risk practitioner is reviewing the status of an action plan to mitigate an emerging IT risk and finds the risk level has increased. The BEST course of action would be to:

A . implement the planned controls and accept the remaining risk.
B . suspend the current action plan in order to reassess the risk.
C . revise the action plan to include additional mitigating controls.
D . evaluate whether selected controls are still appropriate.

Reveal Solution Hide Solution

Question #134

Which of the following is the GREATEST risk associated with an environment that lacks documentation of the architecture?

A . Unknown vulnerabilities
B . Legacy technology systems
C . Network isolation
D . Overlapping threats

Reveal Solution Hide Solution

Correct Answer: A
A

Explanation:

Architecture is the design and structure of a system or a process, such as an IT system or a business process. Architecture documentation is the document that describes and explains the architecture, such as its components, functions, relationships, requirements, constraints, or standards. Architecture documentation can help to understand, communicate, and improve the system or the process1.

An environment that lacks documentation of the architecture faces a great risk of unknown vulnerabilities, which are the weaknesses or flaws in the system or the process that could be exploited by threats or attackers, but are not identified or addressed by the organization. Unknown vulnerabilities can pose a serious risk to the organization, because they can:

Compromise the confidentiality, integrity, and availability of the system or the process, and the information or resources that it handles or supports

Cause financial, operational, reputational, or legal damages or losses to the organization, such as data breaches, fraud, errors, delays, or fines

Remain undetected or unresolved for a long time, and increase the exposure or impact of the risk over time

Require more resources or efforts to mitigate or recover from the risk, and reduce the efficiency or effectiveness of the risk management process23

Lack of documentation of the architecture can increase the risk of unknown vulnerabilities, because it can:

Prevent or hinder the identification and assessment of the vulnerabilities, and the evaluation and prioritization of the risks

Impede or delay the implementation and enforcement of the controls or safeguards to prevent or reduce the vulnerabilities, and the monitoring and reporting of the risk status and progress Obstruct or limit the communication and coordination among the stakeholders, and the awareness and accountability of the risk owners and users

Restrict or hamper the review and improvement of the system or the process, and the learning and feedback of the risk management4

The other options are not the greatest risks associated with an environment that lacks documentation of the architecture, but rather some of the possible causes or consequences of it. Legacy technology systems are outdated or obsolete systems that are still in use by the organization, but are no longer supported or maintained by the vendors or developers. Legacy technology systems can be a cause of lack of documentation of the architecture, as they may have been developed or acquired without proper documentation, or the documentation may have been lost or discarded over time. Network isolation is the separation or segregation of a network or a system from other networks or systems, either physically or logically, to prevent or limit the access or communication between them. Network isolation can be a consequence of lack of documentation of the architecture, as it may result from the inability or difficulty to integrate or connect the system or the process with other systems or processes. Overlapping threats are threats that affect more than one system or process, or have similar or related sources or causes, such as natural disasters, cyberattacks, or human errors. Overlapping threats can be a consequence of lack of documentation of the architecture, as they may arise from the lack of understanding or coordination of the system or the process with other systems or processes.

Reference: =

Architecture Documentation – ISACA

Vulnerability – ISACA

The Risks of Not Having a Vulnerability Management Program The Importance of Architecture Documentation – ISACA [The Risk of Poor Document Control – ComplianceBridge] [CRISC Review Manual, 7th Edition]

Question #135

Who is accountable for risk treatment?

A . Enterprise risk management team
B . Risk mitigation manager
C . Business process owner
D . Risk owner

Reveal Solution Hide Solution

Question #136

Which of the following is MOST important for developing effective key risk indicators (KRIs)?

A . Engaging sponsorship by senior management
B . Utilizing data and resources internal to the organization
C . Including input from risk and business unit management
D . Developing in collaboration with internal audit

Reveal Solution Hide Solution

Correct Answer: C
C

Explanation:

Key risk indicators (KRIs) are metrics used by organizations to monitor and assess potential risks that may impact their objectives and performance. KRIs also provide early warning signals that help organizations identify, analyze, and address risks before they escalate into significant issues1. Effective KRIs are those that are relevant, measurable, predictable, comparable, and informational2. The most important factor for developing effective KRIs is including input from risk and business unit management, as they are the persons who have the best understanding of the risk environment, the risk appetite and tolerance, and the risk factors and impacts of the organization. By including input from risk and business unit management, the organization can ensure that the KRIs are aligned with the organization’s strategy, vision, and mission, and that they reflect the current and emerging risks and their potential consequences. Engaging sponsorship by senior management, utilizing data and resources internal to the organization, and developing in collaboration with internal audit are not the most important factors for developing effective KRIs, as they do not provide the same level of insight and relevance as including input from risk and business unit management. Engaging sponsorship by senior management is a factor that involves obtaining the support and approval of the senior leaders who have the authority and accountability for the organization’s performance and governance. Engaging sponsorship by senior management can help to promote the importance and value of KRIs, and to ensure their communication and implementation across the organization, but it does not ensure that the KRIs are appropriate and accurate for the organization’s risk profile. Utilizing data and resources internal to the organization is a factor that involves using the information and assets that are available within the organization to support or enable the development of KRIs. Utilizing data and resources internal to the organization can help to enhance the quality and reliability of KRIs, and to reduce the cost and complexity of obtaining external data and resources, but it does not ensure that the KRIs are comprehensive and consistent with the organization’s risk environment. Developing in collaboration with internal audit is a factor that involves working with the internal audit function that provides independent and objective assurance and advice on the adequacy and effectiveness of the organization’s risk management. Developing in collaboration with internal audit can help to improve the validity and compliance of KRIs, and to provide feedback and recommendations for improvement, but it does not ensure that the KRIs are relevant and realistic for the organization’s risk objectives and

strategies.

Reference: = 1: Key Risk Indicators: A Practical Guide | SafetyCulture2: KRI Framework for Operational Risk Management | Workiva3: [Risk and Information Systems Control Study Manual, Chapter 4: Risk and Control Monitoring and Reporting, Section 4.1: Key Risk Indicators, pp. 181-185.]

Question #137

Which of the following would MOST effectively enable a business operations manager to identify events exceeding risk thresholds?

A . Continuous monitoring
B . A control self-assessment
C . Transaction logging
D . Benchmarking against peers

Reveal Solution Hide Solution

Correct Answer: A
A

Explanation:

Events exceeding risk thresholds are situations or occurrences that result in the actual level of risk exceeding the acceptable or tolerable level of risk, as defined by the organization’s risk appetite, criteria, and objectives12.

The most effective way to enable a business operations manager to identify events exceeding risk thresholds is to implement continuous monitoring, which is a process that involves collecting and analyzing data and information on the performance and status of the business processes, systems, and controls, and detecting and reporting any deviations, anomalies, or issues that may indicate a risk event34.

Continuous monitoring is the most effective way because it provides timely and accurate visibility

and insight into the risk landscape, and enables the business operations manager to identify and respond to the events exceeding risk thresholds before they escalate or cause significant harm or damage to the organization34.

Continuous monitoring is also the most effective way because it supports the risk management process and objectives, which are to identify and address the risks that may affect the achievement of the organization’s goals and the delivery of value to the stakeholders34.

The other options are not the most effective ways, but rather possible tools or techniques that may complement or enhance the continuous monitoring.

For example:

A control self-assessment is a technique that involves engaging and empowering the business process owners and operators to evaluate and report on the effectiveness and efficiency of the controls that are designed and implemented to mitigate the risks56. However, this technique is not the most effective way because it is periodic rather than continuous, and it may not capture or communicate the events exceeding risk thresholds in a timely or consistent manner56. Transaction logging is a tool that involves recording and storing the details and history of the transactions or activities that are performed by the business processes or systems, and providing an audit trail for verification or investigation purposes78. However, this tool is not the most effective way because it is passive rather than active, and it may not detect or report the events exceeding risk thresholds unless they are analyzed or queried78.

Benchmarking against peers is a technique that involves comparing and contrasting the performance and practices of the business processes or systems with those of the similar or leading organizations in the same or related industry, and identifying the gaps or opportunities for improvement.

However, this technique is not the most effective way because it is external rather than internal, and it may not reflect or align with the organization’s specific risk appetite, criteria, and objectives.

Reference: =

1: Risk IT Framework, ISACA, 2009

2: IT Risk Management Framework, University of Toronto, 2017

3: Continuous Monitoring – ISACA1

4: Continuous Monitoring: A New Approach to Risk Management – ISACA Journal2

5: Risk and control self-assessment – KPMG Global3

6: Control Self Assessments – PwC4

7: Transaction Log – Wikipedia5

8: Transaction Logging – IBM6

: Benchmarking – Wikipedia7

: Benchmarking: Definition, Types, Process, Advantages & Examples

Question #138

An organization has operations in a location that regularly experiences severe weather events.

Which of the following would BEST help to mitigate the risk to operations?

A . Prepare a cost-benefit analysis to evaluate relocation.
B . Prepare a disaster recovery plan (DRP).
C . Conduct a business impact analysis (BIA) for an alternate location.
D . Develop a business continuity plan (BCP).

Reveal Solution Hide Solution

Question #139

A recent internal risk review reveals the majority of core IT application recovery time objectives (RTOs) have exceeded the maximum time defined by the business application owners.

Which of the following is MOST likely to change as a result?

A . Risk forecasting
B . Risk tolerance
C . Risk likelihood
D . Risk appetite

Reveal Solution Hide Solution

Correct Answer: B
B

Explanation:

Recovery time objectives (RTOs) are the maximum acceptable time frames for restoring the critical functions and processes after a disruption1. RTOs are derived from the business impact analysis (BIA) and reflect the organization’s risk appetite, which is the amount of risk that an organization is willing to accept to achieve its objectives2. Risk tolerance is the level of risk a company is willing to tolerate, and it is affected by a number of factors, including how much uncertainty or financial loss can be tolerated and where those losses will impact operations3. Risk tolerance is used to measure if the risk exposure is within the risk appetite and to implement controls to reduce the residual risk to an acceptable level2. If the majority of core IT application RTOs have exceeded the maximum time defined by the business application owners, it means that the organization is not meeting its risk appetite and is exposed to more risk than it can accept. Therefore, the most likely change as a result is to adjust the risk tolerance to reflect the current reality and to take actions to improve the recovery capabilities and reduce the risk exposure4. Risk forecasting is the process of estimating the potential outcomes and impacts of future events that may affect the organization’s objectives5. Risk forecasting may change as a result of the RTOs exceeding the maximum time, but it is not the most likely change, as it does not directly address the gap between the risk appetite and the risk exposure. Risk likelihood is the probability of a risk event occurring5. Risk likelihood may change as a result of the RTOs exceeding the maximum time, but it is not the most likely change, as it does not directly measure the impact of the risk event on the organization’s objectives. Risk appetite is the amount of risk that an organization is willing to accept to achieve its objectives2. Risk appetite may change as a result of the RTOs exceeding the maximum time, but it is not the most likely change, as it is a strategic decision that reflects the organization’s vision and mission, and not a tactical response to a specific risk event.

Reference: = Risk and Information Systems Control Study Manual, Chapter 5: Risk Response and Mitigation, Section 5.3: Business Continuity Planning, pp. 227-238.

Question #140

The MAIN goal of the risk analysis process is to determine the:

A . potential severity of impact
B . frequency and magnitude of loss
C . control deficiencies
D . threats and vulnerabilities

Reveal Solution Hide Solution