Online CRISC Questions Video

A retention policy is a set of rules and guidelines that define how long and under what conditions the information should be kept or disposed of by the organization, based on its value, sensitivity, and legal or regulatory requirements.

When information is no longer required to support business objectives, the first thing that should be done is to assess the information against the retention policy. This means that the information should be reviewed and evaluated to determine if it should be retained or deleted, and for how long and by whom.

Assessing the information against the retention policy helps to ensure that the information is managed and disposed of in a consistent and compliant manner, that the information is protected from unauthorized access, use, disclosure, modification, or destruction, and that the information is available for future reference or audit purposes if needed.

The other options are not the first things that should be done when information is no longer required to support business objectives. They are either secondary or not essential for information management.

The references for this answer are:

Risk IT Framework, page 28

Information Technology & Security, page 22

Risk Scenarios Starter Pack, page 20

A conflict of interest is a situation where a person’s personal or professional interests may interfere with their ability to act in the best interest of the organization or the project1. A conflict of interest can compromise the integrity, objectivity, and impartiality of the person, and create ethical or legal issues for the organization or the project2. In the context of due diligence, a conflict of interest can affect the quality and reliability of the information and analysis, and jeopardize the success and confidentiality of the acquisition3.

The best course of action for a member of the due diligence team who realizes a close acquaintance is a high-ranking IT professional at a subsidiary of the company about to be acquired is to disclose potential conflicts of interest. This means that the team member should inform the due diligence leader and the organization’s management about the relationship with the acquaintance, and explain how it may affect their role or responsibility in the due diligence process. By disclosing potential conflicts of interest, the team member can:

Demonstrate honesty and transparency, and uphold the ethical standards and values of the organization and the project4.

Enable the due diligence leader and the organization’s management to assess the situation and decide the appropriate course of action, such as reassigning the team member, implementing additional controls or safeguards, or obtaining consent or approval from the relevant parties5.

Avoid or minimize the negative consequences or risks that may arise from the conflict of interest, such as legal liability, reputational damage, or loss of trust and credibility6.

References =

Conflict of Interest - CIO Wiki

What is a Conflict of Interest? Give Me Some Examples - The Balance Careers

How to Avoid Conflicts of Interest in M&A Transactions - DealRoom

How to Handle Conflicts of Interest - Harvard Business Review

Conflict of Interest Policy - ISACA

Managing Conflicts of Interest in the Public Sector Toolkit - OECD

 The MOST important consideration when performing a risk assessment of a fire suppression system within a data center is the maintenance procedures, because they ensure that the fire suppression system is functioning properly and reliably, and that it can prevent or minimize the damage caused by fire incidents. The maintenance procedures should include regular testing, inspection, and servicing of the fire suppression system components, such as sprinklers, detectors, alarms, and extinguishers. The other options are not as important as the maintenance procedures, because:

Option A: Insurance coverage is a financial measure that can compensate for the loss or damage caused by fire incidents, but it does not prevent or reduce the likelihood or impact of the fire incidents. Insurance coverage is also dependent on the terms and conditions of the insurance policy, which may not cover all the scenarios or costs of the fire incidents.

Option B: Onsite replacement availability is a contingency measure that can facilitate the recovery or restoration of the fire suppression system after a fire incident, but it does not prevent or reduce the likelihood or impact of the fire incidents. Onsite replacement availability is alsodependent on the availability and compatibility of the replacement parts, which may not match the original fire suppression system specifications or requirements.

Option D: Installation manuals are a reference source that can provide guidance on how to install or configure the fire suppression system, but they do not ensure that the fire suppression system is functioning properly and reliably. Installation manuals are also static documents that may not reflect the current or updated fire suppression system standards or practices. References = Risk and Information Systems Control Study Manual, 7th Edition, ISACA, 2020, p. 211.

 Changes in methods used to calculate probability present the greatest challenge for an IT risk practitioner who wants to report on trends in historical IT risk levels, as they may introduce inconsistency and incomparability in the risk assessment results over time. Probability is a key factor in determining the level and priority of IT risks, and different methods may produce different values for the same risk scenario. For example, some methods may use historical data, expert judgment, or simulation techniques to estimate the likelihood of a risk event. If the methods used to calculate probability change frequently or vary across different business units or processes, the IT risk practitioner may face difficulty in aggregating, normalizing, and reporting the risk levels and trends. The other options are not the greatest challenges for reporting on trends in historical IT risk levels, although they may pose some difficulties or limitations. Qualitative measures for potential loss events are subjective and imprecise, but they can stillprovide a relative ranking of risks and their impacts. Changes in owners for identified IT risk scenarios may affect the accountability and responsibility for managing the risks, but they do not necessarily affect the risk levels or trends. Frequent use of risk acceptance as a treatment option may indicate a high risk appetite ortolerance, but it does not prevent the IT risk practitioner from reporting on the risk levels or trends. References = Risk and Information Systems Control Study Manual, Chapter 5: Risk and Control Monitoring and Reporting, page 181.