Isaca Updated CRISC Exam Questions and Answers by savanna

Business impact analysis (BIA) is a process that involves analyzing the potential consequences of an IT risk event on the organization’s critical business functions and processes. BIA can help to understand the severity and duration of the disruption, the financial and operational losses, the recovery time objectives, and the recovery point objectives. BIA can also help to prioritize the recovery activities and resources, as well as to determine the acceptable level of risk and the risk mitigation strategies. BIA is the most helpful tool to understand the consequences of an IT risk event, as it provides a comprehensive and quantitative assessment of the impact and the recovery requirements. References = Risk and Information Systems Control Study Manual, Chapter 4, Section 4.4.2, p. 206-207

The main purpose of a risk register is to enable well-informed risk management decisions by providing a comprehensive and up-to-date record of all the identified risks, their analysis, and their responses. A risk register is a tool that helps to document, monitor, and communicate the status and outcome of risk management activities. A risk register also facilitates the review and evaluation of the effectiveness of risk management processes and controls. Documenting the risk universe, promoting an understanding of risk,and identifying stakeholders are possible benefits of a risk register, but they are not the main purpose. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 2, Section 2.1.1.3, page 531

1: ISACA Certified in Risk and Information Systems Control (CRISC®) Exam Guide, Answer to Question 640.

The relationship owner is the person who has the authority and responsibility for managing the relationship with the service provider. The relationship owner should be accountable for ensuring that risk responses are implemented, as they are the primary point of contact and communication with the service provider. The relationship owner can also monitor and evaluate the performance and compliance of the service provider, and enforce the contractual obligations and service level agreements. The other options are not as accountable as the relationship owner, as they are related to the assessment, security, or legal aspects of the service provider, not the management or oversight of the service provider. References = Risk and Information Systems Control Study Manual, Chapter 3: IT Risk Response, Section 3.3: IT Risk Response Implementation, page 145.