Isaca Updated CRISC Exam Questions and Answers by camilla

An IT risk register is a document that records and tracks the IT risks that have been identified and assessed by the risk practitioner. It contains information such as the risk description, the risk owner, the risk level, the risk response, the risk status, and the risk monitoring and reporting activities. An IT risk register is a dynamic document that needs to be updated regularly to reflect the changes in the IT environment and the risk landscape. When a software upgrade renders an existing key control ineffective, the risk practitioner should update the IT risk register to indicate the new risk level, the new risk response, and the new risk monitoring and reporting activities. This will ensure that the IT risk register remains accurate, relevant, and useful for IT risk management. Updating the IT risk register is more important than updating the audit engagement letter, the risk profile, or the change control documentation, because the IT risk register is the primary source of information and guidance for managing IT risks. The audit engagement letter is a formal agreement between the auditor and the auditee that defines the scope, objectives, and terms of the audit. The risk profile is a summary of the organization’s risk appetite, risk tolerance, and risk exposure. The change control documentation is a record of the changes that have been made to the IT systems and processes. These documents are important for IT risk management, but they are not as critical as the IT risk register for updating when a key controlbecomes ineffective. References = Risk and Information Systems Control Study Manual, Chapter 2: IT Risk Assessment, Section 2.4: Risk Register, pp. 69-711

A threat risk assessment will best quantify the risk associated with malicious users in an organization, because it focuses on identifying and evaluating the potential sources of harm or damage to the organization’s assets, such as data, systems, or networks. A malicious user is a person who intentionally and unauthorizedly accesses, modifies, destroys, or steals the organization’s information or resources, for personal gain, revenge, espionage, or sabotage. A threat risk assessment can help the organization to estimate the likelihood and impact of malicious user attacks, based on factors such as the user’s motivation, capability, opportunity, and access level. A threat risk assessment can also help the organization to determine the appropriate risk response strategies, such as prevention, detection, mitigation, or transfer, to reduce the risk exposure and impact of malicious user attacks. References = Risk IT Framework, ISACA, 2022, p. 141

Mean time between failures (MTBF) is a key performance indicator (KPI) that measures the average time that a system or component operates without interruption or failure. MTBF is a common metric for reliability and availability of IT services. A higher MTBF indicates a lower frequency of failures and a higher ability to deliver uninterrupted IT services. According to the CRISC Review Manual 2022, MTBF is one of the KPIs for IT service delivery1. According to the CRISC Review Questions, Answers & Explanations Manual 2022, MTBF is the correct answer to this question2.

Mean time to recover (MTTR), planned downtime, and unplanned downtime are not the best KPIs to measure the ability to deliver uninterrupted IT services. MTTR measures the average time that it takes to restore a system or component to normal operation after a failure. Planned downtime measures the scheduled time that a system or component is not available for use due to maintenance or upgrades. Unplanned downtime measures the unscheduled time that a system or component is not available for use due to failures or incidents. These KPIs are useful for measuring the impact and duration of service interruptions, but they do not directly reflect the ability to prevent or avoid service interruptions.

The greatest concern for a risk practitioner when process documentation is incomplete is the inability to identify the risk owner. The risk owner is the person or entity that has the authority and responsibility to manage a specific risk or a group of related risks. The risk owner helps to identify, assess, and respond to the risks, and to monitor and report on the risk performance and improvement. The risk owner also helps to communicate and coordinate the risk management activities with the relevant stakeholders, such as the board, management, business units, and IT functions. The risk owner is usually identified in the process documentation, which describes the roles, responsibilities, procedures, and resources for each process. The inability to identify the risk owner is a major concern for the risk practitioner, because it may affect the accountability, transparency, and effectiveness of the risk management process, and may lead to confusion, conflicts, or gaps in the risk management activities. The other options are not as concerning as the inability to identify the risk owner, although they may also pose some difficulties or limitations for the risk management process. Inability to allocate resources efficiently, inability to complete the risk register, and inability to identify process experts are all factors that could affect the quality and timeliness of the risk management process, but they do not necessarily affect the authority and responsibility of the risk management process. References = Risk and Information Systems Control Study Manual, Chapter 2, Section 2.2.1, page 2-11.