Isaca Updated CRISC Exam Questions and Answers by macsen

Assigning ownership to each risk scenario is fundamental in risk management. Without designated owners, there is a lack of accountability, which can lead to risks not being adequately managed or mitigated. The absence of assigned owners means that no one is responsible for monitoring, reporting, or addressing the risk, increasing the likelihood of adverse outcomes.

Availability requirements specify the expected level of service and the consequences of non-compliance. They are essential for ensuring that the SaaS provider can meet the business continuity and disaster recovery needs of the customer. Codifying them in the contract creates a clear and enforceable agreement that protects both parties.

References

•ISACA CRISC Review Manual, 7th Edition, Domain 3: Risk Response, Section 3.2.3: Business Continuity and Disaster Recovery

•Guideline for Completing Disaster Recovery Plans for SaaS and PaaS Applications (Yale-MSS-3.1 GD.02)

•How to Build a SaaS Disaster Recovery Plan | Acsense

The BEST answer is A because a risk register is the direct repository of identified risk, issues, scenarios, impact, probability, mitigation action, and ownership. For a brainstorming workshop to compile an IT risk profile, previous issues and events from the risk register provide the most relevant starting point for identifying and discussing risk scenarios. The uploaded CRISC notes state that the risk register includes “risk scenario, date, description, impact, probability, risk score, mitigation action and owner,” and that preparation of a risk register begins in the risk identification process. They also state that the risk register is maintained as a repository of identified risk for decision-making.

ISACA’s CRISC outline places Risk Events , Risk Scenario Development and Evaluation , and Risk Register under Domain 2: Risk Assessment, supporting that this is a risk identification/risk assessment activity.

B, C, and D are useful inputs, but they are narrower. Audit findings and control assessment results focus mainly on control weaknesses, while KRIs outside appetite indicate monitored risk conditions. The risk register is broader and more directly aligned to brainstorming an IT risk profile.

===========