Isaca Updated CRISC Exam Questions and Answers by siyana

The most important factor when identifying an organization’s risk exposure associated with IoT devices is visibility into all networked devices. This means having a comprehensive inventory of all the IoT devices connected to the organization’s network, as well as their configurations, functions, and security status. Visibility enables the organization to identify the potential threats and vulnerabilities that IoT devices pose, as well as the impact and likelihood of those risks. Visibility also helps the organization to monitor the behavior and performance of IoT devices, detect any anomalies or incidents, and respond accordingly. Without visibility, the organization may be unaware of the existence, location, or condition of some IoT devices, which could lead to undetected breaches, data loss, or operational disruptions. References = Risk and Information Systems Control Study Manual, Chapter 1: IT Risk Identification, Section 1.4: IT Risk Identification Methods and Techniques, Page 28; 8 Internet of Things Threats and Risks to Be Aware of - SecurityScorecard Blog.

Residual risk exceeds acceptable limits, because it indicates that the risk level is higher than the organization’s risk appetite or tolerance, and that the risk responses and controls are insufficient or ineffective. Residual risk is the level of risk remaining in a process or procedure following the implementation of risk controls to limit or remove it. Escalation is a process that increases the awareness and involvement of higher-level stakeholders or authorities in a risk issue or situation. Escalation is appropriate when the risk issue or situation is outside the scope or authority of the current risk owner or manager, and requires the attention or action of the senior management or the board of directors. Residual risk exceeding acceptable limits is the best situation to justify escalation, as it implies that the current risk owner or manager cannot manage the risk within the predefined boundaries or expectations, and that the senior management or the board of directors need to intervene or approve the risk acceptance or transfer.

Residual risk being inadequately recorded, residual risk remaining after controls have been applied, and residual risk equaling current risk are all possible situations that may require escalation, but they are not the best situations, as they do not necessarily indicate that the risk level is higher than the acceptable limits, and that the senior management or the board of directors need to be involved.

Segregation of duties is a key control for preventing and detecting fraudulent transactions, especially in a large organization where there are many employees and transactions involved. Segregation of duties means that no single person has the authority or ability to initiate, approve, execute, and record a transaction without the involvement or oversight of another person. This reduces the opportunity and incentive for fraud, as well as the risk of errors or omissions. Segregation of duties also facilitates the detection of fraud by creating an audit trail and increasing the likelihood of whistleblowing.

The other options are not as effective as segregation of duties for mitigating risk related to fraudulent transactions. Monetary approval limits (B) are useful for controlling the amount and frequency of transactions, but they do not prevent unauthorized or fraudulent transactions from occurring. Clear roles and responsibilities © are important for defining the expectations and accountabilities of employees, but they do not ensure that employees comply with them or that their actions are monitored and verified. Password policies (D) are essential for securing access to systems and data, but they do not prevent fraudsters from exploiting weak or compromised passwords or from using legitimate passwords for fraudulent purposes.