Isaca Updated CRISC Exam Questions and Answers by olaf

Presenting the impact of IT risks on organizational processes in monetary terms is effective for obtaining management buy-in because it directly relates to the organization ' s financial health and decision-making. It provides a clear and tangible understanding of the potential financialimplications of risks, making it easier for management to appreciate the need for additional controls.

Control effectiveness is best determined throughcontrol testing, which evaluates whether a control operates as intended over time. It includes functional and operational validation under real-world conditions, unlike documentation or design, which only indicate intent.

The BEST answer is C because consolidation should roll up operating-unit risk assessment results into a central enterprise view. Operating units own and identify their local risks, but the enterprise needs an aggregated risk profile for decision-making. The uploaded CRISC notes state that the risk register is the best tool for identifying changes in the enterprise risk profile and that aggregated risk to the enterprise is the most important aspect of a risk profile. They also state that a centrally published risk register with workflow features is the best way to maintain accuracy over time.

ISACA explains that a risk register is a collection of identified risk scenarios incorporated into the enterprisewide risk profile, and that risk registers document risk areas and rank them by likelihood and impact. ISACA’s CRISC outline also includes maintaining or establishing the information system risk register and incorporating it into the enterprisewide risk profile.

A is incorrect because a GRC system is only a tool; it does not define the consolidation approach. B is reversed because enterprise consolidation should aggregate from departmental/unit registers into the central view, not push central items down first. D is unnecessary if operating-unit assessments already exist; creating an enterprise matrix may help reporting, but the best consolidation method is a central risk register.

Real-time monitoring is adetective control, as it is designed to identify and report suspicious or unauthorized activities as they occur. Detective controls provide feedback to mitigate ongoing risks and serve as an integral part of incident response plans.