Isaca Updated CRISC Exam Questions and Answers by rocky

 According to the CRISC Review Manual (Digital Version), the next course of action when an organization has determined a risk scenario is outside the defined risk tolerance level is to identify risk responses, which are the actions or measures taken to address the risk. Identifying risk responses helps to:

Reduce the likelihood and/or impact of the risk to an acceptable level

Align the risk response with the organization’s risk appetite and risk tolerance

Optimize the value and benefits of the risk response

Balance the costs and efforts of the risk response with the potential losses or damages caused by the risk

Coordinate and communicate the risk response with the relevant stakeholders

References = CRISC Review Manual (Digital Version), Chapter 3: IT Risk Response, Section 3.2: Risk Response Process, pp. 161-1621

A risk register is a document that records and tracks the information and status of the identified risks and their responses. It includes the risk description, category, source, cause, impact, probability, priority, response, owner, action plan, status, etc.

A risk register update is a change or modification to the information or status of the risks and their responses in the risk register. It may be triggered by the occurrence or resolution of a risk event, the identification or evaluation of a new or emerging risk, the implementation or completion of a risk response, the monitoring or review of the risk performance, etc.

The most important risk register update for senior management to review is avoiding a risk that was previously accepted, which means that the organization has decided to eliminate or withdraw from the risk exposure or activity that may cause the risk, instead of tolerating or retaining the risk as before. This may indicate a significant change in the organization’s risk appetite, strategy, objectives, or environment, and it may have a major impact on the organization’s performance and value.

The other options are not the most important risk register updates for senior management to review, because they do not indicate a significant change or impact on the organization’s risk profile or performance.

Extending the date of a future action plan by two months means that the organization has postponed the implementation or completion of the planned actions or measures to address the risk, due to some reasons or constraints. This may indicate a delay or deviation from the expected or desired risk outcome, but it may not have a major impact on the organization’s performance and value, unless the risk is very urgent or critical.

Retiring a risk scenario no longer used means that the organization has removed or discarded the risk scenario that is no longer relevant or applicable to the organization’s objectives or operations, due to some changes or developments. This may indicate a reduction or improvement in the organization’s risk exposure or level, but it may not have a major impact on the organization’s performance and value, unless the risk scenario was very significant or influential.

Changing a risk owner means that the organization has assigned or transferred the responsibility and accountability for the risk and its response to a different person or role, due to some reasons or circumstances. This may indicate a change or improvement in the organization’s risk governance or culture, but it may not have a major impact on the organization’s performance and value, unless the risk owner was very ineffective or inappropriate. References =

ISACA, CRISC Review Manual, 7th Edition, 2022, pp. 19-20, 23-24, 27-28, 31-32, 40-41, 47-48, 54-55, 58-59, 62-63

ISACA, CRISC Review Questions, Answers & Explanations Database, 2022, QID 160

CRISC Practice Quiz and Exam Prep

The audit planning process is the process of defining and describing the scope, objectives, and approach of the internal audit that is performed to assess and evaluate the adequacy and effectiveness of the organization’s governance, risk management, and control functions. The audit planning process involves identifying and prioritizing the audit areas, topics, or issues, and allocating the audit resources, time, and budget.

The most important information for a risk practitioner to provide to the internal audit department during the audit planning process is the annual risk assessment results, which are the outcomes or outputs of the risk assessment process that measures and compares the likelihood and impact of various risk scenarios, and prioritizes them based on their significance and urgency. The annual risk assessment results can help the internal audit department to plan the audit by providing the following information:

The level and priority of the risks that may affect the organization’s objectives and operations, and the potential consequences or impacts that they may cause for the organization if they materialize.

The gap or difference between the current and desired level of risk, and the extent or degree to which the risk responses or controls contribute to or affect the gap or difference.

The cost-benefit or feasibility analysis of the possible actions or plans to address or correct the risks and their responses, and the expected or desired outcomes or benefits that they may provide for the organization.

The other options are not the most important information for a risk practitioner to provide to the internal audit department during the audit planning process, because they do not provide the same level of detail and insight that the annual risk assessment results provide, and they may not be relevant or actionable for the internal audit department.

Closed management action plans from the previous audit are the actions or plans that have been implemented or completed by the management to address or correct the findings or recommendations from the previous internal audit that was performed. Closed management action plans from the previous audit can provide useful information on the progress and performance of the management in improving and optimizing the organization’s governance, risk management, and control functions, but they are not the most important information for a risk practitioner to provide to the internal audit department during the audit planning process, because they do not indicate the current or accurate state and performance of the organization’s risk profile, and they may not cover all the relevant or emerging risks that may exist or arise.

An updated vulnerability management report is a report that provides the information and status of the vulnerabilities or weaknesses in the organization’s assets, processes, or systems that can be exploited or compromised by the threats or sources of harm that may affect the organization’s objectives or operations. An updated vulnerability management report can provide useful information on the existence and severity of the vulnerabilities, and the actions or plans to mitigate or prevent them, but it is not the most important information for a risk practitioner to provide to the internal audit department during the audit planning process, because it does not indicate the likelihood and impact of the risk scenarios that are associated with the vulnerabilities, and the potential consequences or impacts that they may cause for the organization.

A list of identified generic risk scenarios is a list that contains the descriptions or representations of the possible or hypothetical situations or events that may cause or result in a risk for the organization, without specifying the details or characteristics of the risk source, event, cause, or impact. A list of identified generic risk scenarios can provide useful information on the types or categories of the risks that may affect the organization, but it is not the most important information for a risk practitioner to provide to the internal audit department during the audit planning process, because it does not indicate the level and priority of the risks, and the potential consequences or impacts that they may cause for the organization. References =

ISACA, CRISC Review Manual, 7th Edition, 2022, pp. 19-20, 23-24, 27-28, 31-32, 40-41, 47-48, 54-55, 58-59, 62-63

ISACA, CRISC Review Questions, Answers & Explanations Database, 2022, QID 188

CRISC Practice Quiz and Exam Prep

A recovery time objective (RTO) is the maximum acceptable time or duration that a business process or function can be disrupted or unavailable due to a disaster or incident, before it causes unacceptable or intolerable consequences for the organization. It is usually expressed in hours, days, or weeks, and it is aligned with the organization’s business continuity and disaster recovery objectives and requirements.

The primary factor in determining a RTO is the cost of downtime due to a disaster, which is the estimated loss or damage that the organization may suffer if a business process or function is disrupted or unavailable for a certain period of time. The cost of downtime can be expressed in terms of financial, operational, reputational, or legal consequences, and it can help the organization to assess the impact and urgency of the disaster, and to decide on the appropriate recovery strategy and resources.

The other options are not the primary factors in determining a RTO, because they do not address the fundamental question of how long the organization can tolerate the disruption or unavailability of a business process or function.

The cost of offsite backup premises is the cost of acquiring, maintaining, or using an alternative or secondary location or facility that can be used to resume or continue the business process or function in case of a disaster or incident. The cost of offsite backup premises is important to consider when selecting or implementing a recovery strategy, but it is not the primary factor in determining a RTO, because it does not indicate the impact or urgency of the disaster, and it may not reflect the organization’s business continuity and disaster recovery objectives and requirements.

The cost of testing the business continuity plan is the cost of conducting, evaluating, or improving the tests or exercises that are performed to verify or validate the effectiveness and efficiency of the business continuity plan, which is the document that describes the actions and procedures that the organization will take to recover or restore the business process or function in case of a disaster or incident. The cost of testing the business continuity plan is important to consider when developing or updating the business continuity plan, but it is not the primary factor in determining a RTO, because it does not indicate the impact or urgency of the disaster, and it may not reflect the organization’s business continuity and disaster recovery objectives and requirements.

The response time of the emergency action plan is the time or duration that it takes for the organization to initiate or execute the emergency action plan, which is the document that describes the immediate actions and procedures that the organization will take to protect the life, health, and safety of the people, and to minimize the damage or loss of the assets,in case of a disaster or incident. The response time of the emergency action plan is important to consider when preparing or reviewing the emergency action plan, but it is not the primary factor in determining a RTO, because it does not indicate the impact or urgency of the disaster, and it may not reflect the organization’s business continuity and disaster recovery objectives and requirements. References =

ISACA, CRISC Review Manual, 7th Edition, 2022, pp. 62-63, 66-67, 70-71, 74-75, 78-79

ISACA, CRISC Review Questions, Answers & Explanations Database, 2022, QID 165

CRISC Practice Quiz and Exam Prep