Isaca Updated CRISC Exam Questions and Answers by harlow

Key Risk Indicators (KRIs)are metrics used to monitor changes in risk exposure, enabling proactive adjustments to keep risks within appetite. They provide early warnings of potential breaches in risk thresholds.

 The best way to assess the effectiveness of an access management process is to reconcile a list of accounts belonging to terminated employees. This will ensure that the access rights of the employees who have left the organization are revoked in a timely and accurate manner, and that there are no orphaned or unauthorized accounts that could pose a security risk. Comparing the actual process with the documented process, reviewing access logs for user activity, and reviewing for compliance with acceptable use policy are also useful methods, but they are not as direct and conclusive as reconciling a list of accounts belonging to terminated employees. References = CRISC Review Manual, 6th Edition, ISACA, 2015, page 217.

 The effectiveness of an employee deprovisioning process can be measured by the number of days taken to remove access after staff separation dates, as this indicates how quickly and completely the organisation can revoke the privileges of former employees and reduce the risk of unauthorized access or data leakage. The number of days taken for IT to remove access after receipt of HR instructions is a measure of the efficiency of the IT department, but not the overall process. The number of termination requests processed per reporting period is a measure of the volume of the process, but not the quality or timeliness. The number of days taken for HR to provide instructions to IT after staff separation dates is a measure of the performance of the HR department, but not the entire process. References = Risk and Information Systems Control Study Manual, Chapter 4: Risk Response, page 152.

Risk mitigation is most effective when the residual risk is optimized, as it means that the risk exposure and impact have been reduced to the level that is aligned with the risk tolerance and appetite of the organization, and that the risk response is cost-effective and optimal. The other options are not the factors that determine the effectiveness of risk mitigation, as they are more related to the types or sources of risk, respectively, rather than the level or outcome of risk. References = CRISC Review Manual, 7th Edition, page 111.