Isaca Updated CRISC Exam Questions and Answers by nella

Risk tolerance and appetite are the expressions of the amount and type of risk that an organization is willing to accept in pursuit of its objectives. Risk tolerance is the acceptable level of variation that the organization is willing to allow for the outcome of its risk decisions. Riskappetite is the broad-based amount of risk that the organization is willing to accept in its activities. The primary objective of establishing an organization’s risk tolerance and appetite is to assist management in decision making, as they provide guidance and boundaries for the risk management activities and decisions. By establishing the risk tolerance and appetite, the organization can align its risk exposure with its strategic goals, optimize its risk-return trade-off, and enhance its risk culture and performance. References = CRISC Review Manual, 7th Edition, page 61.

The correct answer isAbecause in thethree lines model,internal auditorsprovide independent and objective assurance to senior management and the governing body. Their role is separate from operational risk ownership and from second-line oversight functions.

The other options are not correct:

B. Risk ownersare part of the first line and manage risk, but do not provide independent assurance.

C. Regulatorsmay perform external reviews, but they are not part of the organization’s three lines model.

D. Risk management functionsare typically part of the second line and provide oversight, not independent assurance.

Exact Extracts supporting the answer:

“The MOST significant benefit of using the three lines of defense model in a risk management framework of an enterprise is that it clarifies essential roles of the key stakeholders.”

“One of the MAIN purposes of the first line of defense in the three lines of defense model is to ensure control deficiencies are addressed.”

“Establishing a risk management framework is a direct responsibility of the second line of defense.”

“An internal audit function is best positioned to leverage the work performed in monitoring evaluating examining and reporting on controls as part of an ERM program.”

“Evaluating the effectiveness of existing internal information security controls within an enterprise is the responsibility of the system auditor.”

These extracts support that independent and objective assurance in the three lines model is provided byinternal auditors.

Residual system access is the risk that the customer service representatives who are transferred to the sales department may still have access to the systems or applications that they used in their previous role, which may not be relevant or authorized for their new role.

The access control manager is the person or function who is responsible for defining, implementing, and maintaining the policies and procedures for granting, modifying, reviewing, and revoking access rights to the systems or applications, based on the principle of least privilege and the segregation of duties.

The access control manager is responsible for mitigating the risk associated with residual system access, by ensuring that the access rights of the customer service representatives are updated or removed according to their new role and responsibilities, and that the access changes are documented and approved by the appropriate authorities.

The other options are not responsible for mitigating the risk associated with residual system access. They are either irrelevant or less effective than the access control manager.

The references for this answer are:

Risk IT Framework, page 26

Information Technology & Security, page 20

Risk Scenarios Starter Pack, page 18