Question 391 · 1449 in bank
Which stakeholder is MOST important to include when defining a risk profile during the selection process for a new third-party application?
Show answer
Answer: D
Certified in Risk and Information Systems Control1,449 questions across 145 pages are complete and free, with no account or card.
1449 questions in this bank
Free access · progress saved on this device
Which stakeholder is MOST important to include when defining a risk profile during the selection process for a new third-party application?
Answer: D
Who is MOST appropriate to be assigned ownership of a control?
Answer: A
The BEST indicator of the risk appetite of an organization is the:
Answer: C
The BEST indicator of the risk appetite of an organization is the board of directors’ response to identified risk factors. The risk appetite of an organization refers to the amount and type of risk that the organization is willing to take in pursuit of its objectives. The board of directors is ultimately responsible for setting the tone at the top with respect to risk management and determining the organization's overall risk appetite.
Source: Adapted from community discussion — john_boogieman
An organization’s business gap analysis reveals the need for a robust IT risk strategy. Which of the following should be the risk practitioner’s PRIMARY consideration when participating in development of the new strategy?
Answer: C
An organization has operations in a location that regularly experiences severe weather events. Which of the following would BEST help to mitigate the risk to operations?
Answer: B
B. Develop a business continuity plan (BCP). Developing a business continuity plan (BCP) would best help to mitigate the risk to operations in a location that regularly experiences severe weather events. A BCP provides a comprehensive framework for maintaining and resuming critical business functions in the event of a disruption, such as severe weather. This plan includes strategies to ensure the organization's continued operations, alternative arrangements, and recovery of key resources and processes.
Source: Adapted from community discussion — Broesweelies
Which of the following BEST balances the costs and benefits of managing IT risk?
Answer: B
Prioritizing and addressing risk in line with risk appetite best balances the costs and benefits of managing IT risk. By aligning risk management efforts with the organization's risk appetite, resources can be allocated efficiently, and focus can be given to the most significant risks that could impact the organization's objectives. This approach ensures that risk management investments are proportional to the potential benefits and the organization's overall risk tolerance.
Source: Adapted from community discussion — Broesweelies
Which of the following would provide the MOST useful input when evaluating the appropriateness of risk responses?
Answer: A
A. Cost-benefit analysis A cost-benefit analysis would provide the most useful input when evaluating the appropriateness of risk responses. By comparing the costs of implementing a specific risk response with the potential benefits, an organization can make informed decisions on whether the response is appropriate and effective in managing the identified risk. This approach ensures that resources are allocated efficiently and that risk management efforts are proportional to the potential benefits.
Source: Adapted from community discussion — Broesweelies
Which of the following BEST enables effective IT control implementation?
Answer: A
A. Information security policies Information security policies best enable effective IT control implementation. Policies provide a high-level framework that guides an organization's approach to information security, setting out the principles, goals, and requirements for protecting information assets. They serve as the foundation for designing, implementing, and maintaining IT controls throughout the organization.
Source: Adapted from community discussion — Broesweelies
An organization recently acquired a new business division. Which of the following is MOST likely to be affected?
Answer: C
While one should be aware of departments that may have their own subcultures, changes in the risk profile can be the result of various factors, such as mergers or acquisitions, and new risks emerge.
Source: Adapted from community discussion — john_boogieman
One of an organization’s key IT systems cannot be patched because the patches interfere with critical business application functionalities. Which of the following would be the risk practitioner’s BEST recommendation?
Answer: C
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CRISC practice, question 391. 1449 questions available.
Version 1.0.0. How we source questions