Isaca Updated CRISC Exam Questions and Answers by jakub

A noncompliant control is a control that does not meet the requirements or standards of an audit, regulation, or policy. A noncompliant control can expose the organization to risks such as errors, fraud, or breaches. When a noncompliant control is identified, the service provider and the client should work together to resolve the issue as soon as possible. However, sometimes the resolution may not be feasible or cost-effective, and the client may decide to accept the risk associated with the noncompliant control.

In this case, the service provider’s most appropriate action would be to ask the client to document the formal risk acceptance for the provider. This means that the client should acknowledge the existence and consequences of the noncompliant control, and provide a written justification for accepting the risk. The risk acceptance document should also specify the roles and responsibilities of the service provider and the client, and the duration and conditions of the risk acceptance. The risk acceptance document should be signed by the client’s senior management and the service provider’s management, and kept as part of the audit evidence.

The other options are not appropriate actions for the service provider. Developing a risk remediation plan overriding the client’s decision would be disrespectful and unprofessional, as it would ignore the client’s authority and preference. Making a note for this item in the next audit explaining the situation would be insufficient and misleading, as it would imply that the issue is still unresolved and that the service provider is responsible for it. Insisting that the remediation occur for the benefit of other customers would be unreasonable and impractical, as it woulddisregard the client’s business needs and constraints, and potentially harm the relationship between the service provider and the client. References =

Risk Acceptance - Institute of Internal Auditors

New Guidance on the Evaluation of Non-compliance with the Risk Assessment Standard and its Peer Review Impact - REVISED

The Impact of Non-compliance: Understanding The Risks And Consequences

The risk practitioner shouldfirst review the methodology of the BIAbecause the BIA identifies critical processes and the impacts of disruptions. This ensures that any identified risks are grounded in reliable, updated business impact data.

===========

A root cause analysis is a process of identifying and understanding the underlying or fundamental causes or factors that contribute to or result in a problem or incident that has occurred or may occur in the organization. A root cause analysis can provide useful insights and solutions on the origin and nature of the problem or incident, and prevent or reduce its recurrence or impact.

Performing a root cause analysis is the risk practitioner’s best recommendation when the number of tickets to rework application code has significantly exceeded the established threshold, because it can help the organization to address the following questions:

Why did the application code require rework?

What were the errors or defects in the application code?

How did the errors or defects affect the functionality or usability of the application?

Who was responsible or accountable for the application code development and testing?

When and how were the errors or defects detected and reported?

What were the costs or consequences of the rework for the organization and its stakeholders?

How can the errors or defects be prevented or minimized in the future?

Performing a root cause analysis can help the organization to improve and optimize the application code quality and performance, and to reduce or eliminate the need for rework. It can also help the organization to align the application code development and testing with the organization’s objectives and requirements, and to comply with the organization’s policies and standards.

The other options are not the risk practitioner’s best recommendations when the number of tickets to rework application code has significantly exceeded the established threshold, because they do not address the main purpose and benefit of performing a root cause analysis, which is to identify and understand the underlying or fundamental causes or factors that contribute to or result in the problem or incident.

Performing a code review is a process of examining and evaluating the application code for its quality, functionality, and security, using the input and feedback from the peers, experts, or tools. Performing a code review can help the organization to identify and resolve the errors or defects in the application code, but it is not the risk practitioner’s best recommendation, because it doesnot indicate why the application code required rework, and how the errors or defects affected the organization and its stakeholders.

Implementing version control software is a process of using a software tool to manage and track the changes and modifications to the application code, and to ensure the consistency and integrity of the application code. Implementing version control software can help theorganization to control and monitor the application code development and testing, but it is not the risk practitioner’s best recommendation, because it does not indicate why the application code required rework, and how the errors or defects affected the organization and its stakeholders.

Implementing training on coding best practices is a process of providing and facilitating the learning and development of the skills and knowledge on the principles, guidelines, and standards for the application code development and testing. Implementing training on coding best practices can help the organization to enhance the competence and performance of the application code developers and testers, but it is not the risk practitioner’s best recommendation, because it does not indicate why the application code required rework, and how the errors or defects affected the organization and its stakeholders. References =

ISACA, CRISC Review Manual, 7th Edition, 2022, pp. 40-41, 47-48, 54-55, 58-59, 62-63

ISACA, CRISC Review Questions, Answers & Explanations Database, 2022, QID 189

CRISC Practice Quiz and Exam Prep