CRISC Isaca Exam Lab Questions

A risk practitioner notices a trend of noncompliance with an IT-related control. This indicates that there is a risk of ineffective or inefficient implementation or operation of the control, which may expose the organization to potential threats or losses.

The best way to assist in making a recommendation to management is to assess the degree to which the control hinders business objectives. This means that the risk practitioner should analyze the impact of the control on the performance, productivity, quality, or customer satisfaction of the business processes or functions that are affected by the control.

Assessing the degree to which the control hinders business objectives helps to identify the root causes of noncompliance, the costs and benefits of compliance, and the potential alternatives or improvements for the control. It also helps to communicate the value and importance of the control to the management and the stakeholders, and to obtain their support and commitment for the control compliance.

The other options are not the best ways to assist in making a recommendation to management. They are either secondary or not essential for control compliance.

The references for this answer are:

Risk IT Framework, page 19

Information Technology & Security, page 13

Risk Scenarios Starter Pack, page 11

Key risk indicator (KRI): A metric that measures the level of risk exposure or the likelihood of a risk event1.

KRI threshold: A predefined value or range that triggers an alert or action when the KRI reaches or exceeds it2.

Loss expectancy: The estimated amount of loss that an organization may incur due to a risk event3.

The most helpful thing in developing KRI thresholds is loss expectancy information. Loss expectancy information provides an estimate of the potential or expected impact of a risk event on the organization’s operations, reputation, or objectives. Loss expectancy information can help an organization to:

Quantify and prioritize the risks that pose the greatest threat to the organization

Determine the acceptable level of risk exposure or tolerance for each risk

Set the appropriate value or range for the KRI threshold that reflects the risk appetite and the risk mitigation strategy

Monitor and measure the performance and effectiveness of the risk management process and controls

Loss expectancy information can be derived from various sources, such as historical data, statistical analysis, expert judgment, or simulation models3.

The other options are not as helpful as loss expectancy information in developing KRI thresholds, because they do not directly address the potential or expected impact of a risk event.Control performance predictions, which are the forecasts or estimates of how well the risk management controls will perform in preventing, detecting, or mitigating risks, may help to evaluate the adequacy and efficiency of the risk management process and controls, but they do not provide a clear and quantifiable measure of the risk impact. IT service level agreements (SLAs), which are the contracts or agreements that define the quality and availability of IT services, may help to establish the standards and expectations for IT service delivery and performance, but they do not provide a comprehensive and current view of the risk exposure or likelihood. Remediation activity progress, which is the status or outcome of the actions taken to address and resolve a risk event, may help to monitor and report the effectiveness and compliance of the risk management process and controls, but it is usually done after the risk event has occurred and resolved, not before.

References = Key Risk Indicators: Definition, Examples, and Best Practices, KRI Framework for Operational Risk Management | Workiva, Loss Expectancy: Definition, Calculation, and Examples

An increase in the number of security incidents is the most significant indicator of the need to perform a penetration test, because it suggests that the organization’s IT systems or networks are vulnerable to attacks and may not have adequate security controls in place. A penetration test is a simulated attack on an IT system or network to identify and exploit its weaknesses and evaluate its security posture. A penetration test can help to discover and remediate the vulnerabilities that may have caused or contributed to the security incidents, and to prevent or reduce the likelihood and impact of future incidents. An increase in the number of high-risk audit findings, an increase in the percentage of turnover in IT personnel, and an increase in the number of infrastructure changes are all possible indicators of the need to perform a penetration test, but they are not the most significant indicator, as they do not directly reflect the actual or potential occurrence of security incidents. References = Risk and Information Systems Control Study Manual, Chapter 5, Section 5.3.2, page 200