Changed CRISC Exam Questions

Obfuscating customer information ensures data privacy by rendering sensitive details unintelligible to unauthorized parties, reducing the risk of exposure during transit or processing. This aligns withData Protection and Privacy Regulationsunder risk management frameworks, emphasizing safeguarding personally identifiable information.

Ongoing availability of data is the most important consideration when selecting key risk indicators (KRIs) to monitor risk trends over time, as it ensures that the KRIs can provide timely and reliable information on the current and future risk status and performance. KRIs are metrics that measure the level of risk exposureand the effectiveness of risk response strategies, and they should be aligned with the enterprise’s risk appetite and objectives. Ongoing availability ofdatameans that the data sources and collection methods for the KRIs are consistent, accessible, and sustainable, and that the data quality and integrity are maintained and verified. Ability to aggregate data, ability to predict trends, and availability of automated reporting systems are not the most important considerations, as they do not affect the validity and usefulness of the KRIs, but rather the presentation and analysis of the KRI data. References = CRISC Certified in Risk and Information Systems Control – Question213; ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, question 213.

The risk register is a living document. CRISC states it should be maintained so that it accurately reflects current risk conditions, including changes in threats, vulnerabilities, impacts, controls, and ownership. Therefore, it is most important to update entrieswhen aspects of the risk scenario change—for example, when a new control is implemented, business processes change, threat activity increases, or the magnitude of impact alters. Waiting until KRI thresholds are reached may delay updating until risk is already elevated. Updating only when internal audit requires it or just before a periodic review undermines real-time visibility and decision-making. Timely updates when the scenario changes support effective monitoring, reporting, and governance, ensuring that management decisions are based on current, not outdated, risk information.

The correct answer is B . Executive/senior management is accountable for ensuring the organization operates within legal and regulatory requirements and for approving risk appetite and tolerance. The uploaded CRISC notes state that senior management is responsible for approving the enterprise’s risk appetite and tolerance related to information security. They also state that risk tolerance is the permissible deviation from declared risk appetite levels.

Operational management manages day-to-day risk and controls, but it does not set enterprise-level tolerance. Standards and ethics committees may provide guidance, but they are not primarily accountable for regulatory compliance and enterprise risk tolerance.

===========