Ace Your CRISC Isaca Certification Exam

According to the three lines of defense model, the responsibility for managing risk and controls resides with the operational management, which forms the first line of defense. The operational management is the function that owns and manages risk as part of their accountability for achieving objectives. They are responsible for identifying, assessing, mitigating, and reportingon risks and controls within their areas ofoperation. They are also responsible for implementing and maintaining effective internal controls and ensuring compliance with policies, standards, and regulations.

The correct answer isDbecauseresidual riskis the remaining risk after controls and risk responses have been implemented, and it is the key measure used to determine whether the organization’s current level of risk is within its establishedrisk appetite. To assess whether risk has been appropriately managed, the organization must compare the remaining exposure, not the untreated exposure, against acceptable thresholds.

The other options are less appropriate:

A. Inherent riskrepresents risk before controls and therefore does not show whether risk has been appropriately managed.

B. Risk velocityindicates speed of impact, but not whether risk is within appetite.

C. Risk trendshows movement over time, but not the actual remaining exposure compared with appetite.

Exact Extracts supporting the answer:

“The most suitable output for justifying an information security program is considering residual risk in terms of acceptable risk.”

“The primary objective of a risk management program is to maintain residual risk at an acceptable level.”

“Residual risk is best reflected as risk remaining after the implementation of new or enhanced controls.”

“Acceptable risk for an enterprise is achieved when residual risk is within tolerance levels.”

“A successful risk management practice is indicated by minimizing residual risk.”

These extracts directly support thatresidual riskis the most useful information when comparing managed risk against established risk appetite.

===========

KPIs provide metrics that show whether processes and controls are meeting performance targets. CRISC explains that KPIs help identifyhow efficiently controls or processes are operating. They provide a leading view of performance, enabling early identification of inefficiencies that may lead to increased risk. KPIs do not measure cost effectiveness, ROI, or changes in risk tolerance—those belong to financial or strategic measurement systems. Control efficiency aligns directly with KPI use because KPIs measure operational results against objectives.

The correct answer is B because enterprise architecture exists to align enterprise structure, processes, systems, data, and technology with business objectives. If EA artifacts are incompatible with business objectives, the architecture outputs will directly drive misaligned decisions, investments, and controls. ISACA states that the purpose of enterprise architecture is to ensure that enterprise structure aligns with business goals and that processes, systems, and technologies are integrated effectively.

The uploaded CRISC notes also support the same principle: business objectives and operations are crucial when defining risk management strategies, strategic planning and business requirements should drive the IT plan, and enterprise security architecture exists to align security strategies across the enterprise.

A, C, and D may create weaknesses or incomplete architecture, but they are not as directly responsible for misaligned outcomes as EA artifacts that are incompatible with business objectives.

===========