Isaca Updated CRISC Exam Questions and Answers by camilla

Verifying the deficiency and then notifying the business process owner is the best response when a potential IT control deficiency has been identified. This is because verifying the deficiency can help confirm the existence, nature, and extent of the deficiency, as well as its root causes and impacts. Notifying the business process owner can help ensure that the deficiency is communicated to the person who is responsible for the process and its outcomes, and who has the authority and accountability to take appropriate actions to address the deficiency. According to the CRISC Review Manual 2022, one of the key risk response techniques is to report the risk to the relevant stakeholders, such as the business process owners1. According to the CRISC Review Questions, Answers & Explanations Manual 2022, verifying the deficiency and then notifying the business process owner is the correct answer to this question2.

Remediating and reporting the deficiency to the enterprise risk committee or senior executive management are not the best responses when a potential IT control deficiency has been identified. These are possible actions that can be taken after the deficiency has been verified and notified to the business process owner, but they are not the first or immediate responses. Remediating the deficiency without verifying it can lead to ineffective or inappropriate solutions, as well as wasted time and resources. Reporting the deficiency to the enterprise risk committee or senior executive management without notifying the business process owner cancreate confusion, conflict, or delay in the risk response process, as well as undermine the ownership and accountability of the business process owner.

The most effective way for a large and diversified organization to minimize risk associated with unauthorized software on company devices is to scan end points for applications not included in the asset inventory. An asset inventory is a document that records and tracks all the hardware and software assets that are owned, used, or managed by the organization, such as laptops, tablets, smartphones, servers, applications, etc. An asset inventory helps to identify and classify the assets based on their type, model, location, owner, status, etc. An asset inventory also helps to monitor and control the assets, such as enforcing security policies, applying patches and updates, detecting and resolving issues, etc. Scanningend points for applications not included in the asset inventory helps to minimize the risk of unauthorized software, because it helps to discover and remove any software that is not approved, authorized, or licensed by the organization, and that may pose security, legal, or operational risks, such as malware, spyware, pirated software, etc. The other options are not as effective as scanning end points for applications not included in the asset inventory, although they may provide some protection or compliance for the software assets. Prohibiting the use of cloud-based virtual desktop software, conducting frequent reviews of software licenses, and performing frequent internal audits of enterprise IT infrastructure are all examples of preventive or detective controls, which may help to prevent or deter the installation or use of unauthorized software, or to verify or validate the software assets, but they do not necessarily discover or remove the unauthorized software. References = Risk and Information Systems Control Study Manual, Chapter 3, Section 3.2.1, page 3-11.

Scalable infrastructure ensures the system can handle increased load without failure, thus minimizing the risk of downtime or degraded performance during traffic spikes.

The result of postponing the assessment and treatment of several risk scenarios is that the risk associated with these new entries has been accepted. Risk acceptance is a risk response strategy that involves acknowledging the existence of a risk and deciding not to take any action to reduce its likelihood or impact. By postponing the assessment and treatment of the risk scenarios, the organization is implicitly accepting the risk and its consequences. Risk mitigation, deferral, and transfer are other possible risk response strategies, but they are not applicable in this case. References = ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, question 9; CRISC Review Manual, 6th Edition, page 137.