Download Latest CRISC Questions

A risk heat map is a graphical tool that displays the level of risk for each risk area based on the impact and likelihood of occurrence. It also provides a summary of the risk assessment results, such as the number and severity of risks, the risk appetite and tolerance, and the risk response strategies. A risk heat map can help senior management to understand the risk profile of the organization, prioritize the risks that need attention, and allocate resources accordingly. A risk heat map is more effective than the other options because it can communicate complex information in a simple and visual way, and it can highlight the key risk areas and trends. References = Risk and Information Systems Control Study Manual, Chapter 3, Section 3.4.2, page 97.

The RPO defines how much data loss is acceptable during system failure. If not clearly defined, restoration may skip key data, leading to incomplete recovery. ISACA guidelines highlight that alignment of RPO/RTO with business objectives is critical for viable DR planning

 A change in the risk profile would be the most important information to communicate to stakeholders after an annual risk assessment is completed, as it indicates how the risk landscape of the organization has changed over time, and how it affects the achievement of the business goals and objectives. A decrease in threats, an increase in reported vulnerabilities, and an increase in identified risk scenarios are also important information, but they are not the most important, as they are specific aspects of the risk profile, and do not provide a holistic view of the risk exposure and appetite of the organization. References = CRISC Review Manual, 7th Edition, page 109.

Shadow systems are IT systems, solutions, devices, or technologies used within an organization without the knowledge and approval of the corporate IT department1. They are often the result ofemployees trying to address specific functionality gaps in the organization’s official systems, such as the ERP system. However, shadow systems can pose significant risks to the organization, such as:

Data security and privacy breaches, as shadow systems may not comply with the organization’s security policies and standards, or may expose sensitive data to unauthorized parties2.

Data quality and integrity issues, as shadow systems may not synchronize or integrate with the organization’s official systems, or may create data inconsistencies or redundancies3.

Compliance and regulatory violations, as shadow systems may not adhere to the organization’s legal or contractual obligations, or may create audit or reporting challenges4.

Cost and resource inefficiencies, as shadow systems may duplicate or conflict with the organization’s official systems, or may consume more IT resources than necessary5.

The best way to reduce the risk associated with shadow systems is to implement an enterprise architecture (EA), which is a comprehensive framework that defines the structure, processes, principles, and standards of the organization’s IT environment6. By implementing an EA, the organization can:

Align the IT systems with the organization’s goals and strategy, and ensure that they support the business needs and requirements6.

Establish a governance structure and process for IT decision making, and ensure that all IT systems are approved, monitored, and controlled by the IT department7.

Enhance the communication and collaboration between the IT department and the business units, and ensure that the IT systems meet the expectations and preferences of the end users5.

Optimize the performance and efficiency of the IT systems, and ensure that they are scalable, flexible, and interoperable6.

References =

Shadow IT: What Are the Risks and How Can You Mitigate Them? - Ekran System

How to Reduce Risks of Shadow IT by Applying Governance to Public Clouds – BMC Software | Blogs

What is shadow IT? - Article | SailPoint

The Risks of Shadow IT and How to Avoid Them | SiteSpect

Start reducing your organization’s Shadow IT risk in 3 steps

What is enterprise architecture (EA)? - Definition from WhatIs.com

Enterprise Architecture Governance - CIO Wiki