Isaca CRISC Online Access

Residual risk is the risk that remains after applying risk responses, such as avoidance, mitigation, transfer, or acceptance. It represents the level of exposure that the organisation is willing to tolerate or assume. Residual risk should be aligned with the organisation’s risk appetite and risk tolerance, which are determined by senior management. Therefore, the best way to obtain senior management support for investment in a control implementation would be to articulate the reduction in residual risk that the control would achieve. This would demonstrate how the control would help the organisation meet its riskobjectives and reduce the likelihood or impact of adverse events. References = ISACA CRISC Review Manual, 7th Edition, Chapter 1, Section 1.3.2, page 25.

The observation from a third-party service provider review that would be of greatest concern to a risk practitioner is that the service level agreements (SLAs) have not been met over the last quarter, as it indicates a significant performance issue or breach that may affect the quality, functionality, or security of the outsourced services, and may require a remediation or escalation action. The other options are not the greatest concerns, as they may not indicate a performance issue or breach, but rather a contractual, personnel, or financial issue, respectively, that may not affect the outsourced services directly or significantly. References = CRISC Review Manual, 7th Edition, page 111.

According to the Gaining the competitive edge – measuring and assessing an organization’s risk culture article, risk appetite is the amount and type of risk that an organization is willing to accept in pursuit of its objectives. Risk appetite should be aligned with the organization’s strategy, goals, and values, and should reflect the organization’s risk culture and capabilities. One of the main considerations when validating an organization’s risk appetite is the capacity to withstand loss, which is the ability of the organization to absorb the impact of adverse events without jeopardizing its viability or reputation. The capacity to withstand loss depends on various factors, such as the financial strength, the operational resilience, the governance structure, and the stakeholder expectations of the organization. By assessing the capacity to withstand loss, the organization can determine if its risk appetite is realistic and appropriate, or if it needs to be adjusted to match its risk profile and environment. References = Gaining the competitive edge – measuring and assessing an organization’s risk culture

The most helpful action to ensure the effective implementation of a new cybersecurity program is assigning clear ownership of the program. Here ' s why:

Clear Ownership:

Assigning clear ownership ensures that there is accountability and responsibility for the implementation and success of the program.

The program owner will coordinate activities, allocate resources, and monitor progress to ensure that objectives are met.

Creating Metrics:

While metrics are important for monitoring and reporting, they do not directly ensure the effective implementation of the program.

Hiring Subject Matter Experts:

Subject matter experts are valuable for providing insights and guidance, but without clear ownership, their efforts may not be effectively coordinated or aligned with program goals.

Establishing a Budget:

A budget is necessary for securing resources, but it must be managed and directed by a responsible owner to ensure the effective use of those resources.