Question 51 · 1449 in bank
An organization has decided to use an external auditor to review the control environment of an outsourced service provider. The BEST control criteria to evaluate the provider would be based on:
Show answer
Answer: D
Certified in Risk and Information Systems Control1,449 questions across 145 pages are complete and free, with no account or card.
1449 questions in this bank
Free access · progress saved on this device
An organization has decided to use an external auditor to review the control environment of an outsourced service provider. The BEST control criteria to evaluate the provider would be based on:
Answer: D
A global company's business continuity plan (BCP) requires the transfer of its customer information systems to an overseas cloud service provider in the event of a disaster. Which of the following should be the MOST important risk consideration?
Answer: A
Which of the following will MOST effectively align IT controls with corporate risk tolerance?
Answer: B
Correction, reason: Internal policies approved by stakeholders establish the expectations and requirements for managing risk within an organization. These policies provide guidance on the appropriate controls to implement to manage risks, as well as the consequences of non-compliance. By aligning IT controls with internal policies approved by stakeholders, IT functions can ensure that they are following the organization's risk management framework and that their controls are consistent with the organization's risk tolerance. This helps to ensure that the IT controls are focused on the most critical risks facing the organization and are appropriate for the organization's risk appetite. Key performance indicators (KPIs) approved by stakeholders can be a useful tool for monitoring and measuring the effectiveness of IT controls. However, KPIs alone may not be sufficient to align IT controls with corporate risk tolerance. KPIs are typically focused on specific metrics or goals and may not provide the broader context needed to ensure that IT controls are aligned with the organization's overall risk management framework.
Source: Adapted from community discussion — john_boogieman
Which of the following is MOST likely to be impacted as a result of a new policy which allows staff members to remotely connect to the organization's IT systems via personal or public computers?
Answer: C
Inherent risk is correct as due to new policy risk is generated which requires controls to implemented. KRI is indicator to monitor risk
Source: Adapted from community discussion — Annyp
Which of the following is the MOST important success factor when introducing risk management in an organization?
Answer: A
The most important success factor when introducing risk management in an organization is strong support and commitment from senior management.
Source: Adapted from community discussion — john_boogieman
Which of the following is the MOST effective inhibitor of relevant and efficient communication?
Answer: C
When developing risk scenarios using a list of generic scenarios based on industry best practices, it is MOST important to:
Answer: B
The MOST significant benefit of using a consistent risk ranking methodology across an organization is that it enables:
Answer: D
Which of the following is MOST important for a risk practitioner to consider when evaluating plans for changes to IT services?
Answer: B
Which of the following should be the FIRST step to investigate an IT monitoring system that has a decreasing alert rate?
Answer: B
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CRISC practice, question 51. 1449 questions available.
Version 1.0.0. How we source questions