CRISC Exam Dumps - Certified in Risk and Information Systems Control

IT disaster recovery point objectives (RPOs) should be based on the:

B. maximum tolerable loss of data.

RPOs are determined by how much data loss an organization can withstand in the event of a disaster. It’s a measure of the maximum age of files that an organization must recover from backup storage for normal operations to resume after a disaster. Therefore, RPOs are directly related to the maximum tolerable loss of data.

A risk heat map is a graphical tool that displays the overall risk of the project to senior management by showing the probability and impact of individual risks in a matrix format. A risk heat map can help to prioritize the risks, communicate the risk exposure, and monitor the risk response. A risk heat map can also show the risk appetite and tolerance levels of the organization, as well as the residual risk after the risk response. The other options are not the most effective ways to represent the overall risk of the project to senior management, although they may be useful or complementary to the risk heat map. Aggregated key performance indicators (KPIs) are metrics that measure the performance of the project against the objectives, but they do not show the uncertainty or variability of the project outcomes. Key risk indicators (KRIs) are metrics that measure the level of risk or the effectiveness of the risk response, but they do not show the relationship between the probability and impact of the risks. A centralized risk register is a document that records the details of the individual risks, such as the description, category, cause, effect, probability, impact, response, and status, but it does not show the overall risk of the project in a visual or concise way. References = Managing overall project risk, Project Risk Management – Quick Reference Guide, 10 Common Project Risks (Plus the Steps To Solve Them), What Is Project Risk Management: Benefits, Challenges, Best Practices

A purchase order approval process is a set of procedures that companies use to authorize the purchase of goods or services from suppliers1. This process typically involves multiple levels of approvals, ensuring that purchases are compliant with company regulations and policies, and within budget limitations1. Sometimes, a department may be granted an exception to bypass the existing approval process for purchase orders, for example, due to urgency, emergency, or special circumstances2. However, such exceptions should not compromise the effectiveness and integrity of the purchase order approval process, and should be properly documented and justified2. Therefore, the risk practitioner should verify that the exception has been approved by senior management, as they are ultimately responsible for setting and overseeing the purchase order approval process, and for ensuring that the exceptions are reasonable and aligned with the company’s objectives and risk appetite3. Internal audit is not the correct answer, as they are not involved in approving the purchase order approval process or its exceptions. Internal audit’s role is to provide independent assurance and advice on the adequacy and effectiveness of the purchase order approval process and its controls, and to report any issues or recommendations for improvement4. Control owner is not the correct answer, as they are not involved in approving the purchase order approval process or its exceptions. Control owner’s role is to design, implement, and operate the controls that support the purchase order approval process, and to monitor and report on the performance and compliance of the controls5. Risk manager is not the correct answer, as they are not involved in approving the purchase order approval process or its exceptions. Risk manager’s role is to identify, assess, and mitigate the risks associated with the purchase order approval process, and to communicate and report on the risk status and issues6. References = 1: A Step-by-Step Guide to a Purchase Order Approval Process2: Purchase Order Exceptions | Fordham3: Purchase Order (PO) Approval Process and Approval Workflow - ProcureDesk4: IT Risk Resources | ISACA5: CRISC Resources [updated 2021] | Infosec6: Risk and Information Systems Control Study Manual, Chapter 4: Risk and Control Monitoring and Reporting, Section 4.2: Risk Monitoring, pp. 189-191.

According to the CRISC Review Manual1, data selection is the process of choosing the appropriate data sources and variables for data analysis. Data selection is the most critical step in data analytics, as it determines the quality and validity of the results and insights derived from the analysis. Incorrect data selection is the greatest risk associated with the use of data analytics, as it can lead to inaccurate, incomplete, irrelevant, or biased outcomes that can adversely affect the decision making and performance of the organization. Incorrect data selection can also cause legal, regulatory, ethical, or reputational issues for the organization, if the data used for analysis is not authorized, reliable, or compliant. References = CRISC Review Manual1, page 255.

 Risk scenarios are hypothetical situations that describe potential events or actions that could affect the achievement of enterprise objectives. The design of relevant risk scenarios should consider the following factors: the risk appetite and tolerance of the enterprise, the key risk indicators and risk drivers, the potential impact and likelihood of the scenarios, and the alignment with the risk management capabilities of the enterprise. The scenarios should be realistic, plausible, and consistent with the enterprise’s context and objectives. The scenarios should also be reviewed and updated periodically to reflect changes in the internal and external environment. The alignment with the risk management capabilities is the most critical factor, as it ensures that the scenarios are relevant for the decision making and risk response processes of the enterprise. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 2, Section 2.3.3.2, pp. 67-69.

A loss event is an occurrence that results in a negative consequence or damage for an organization, such as a data breach, a cyberattack, or a natural disaster. The impact of a loss event is the extent or magnitude of the harm or loss caused by the event, such as financial losses, reputational damage, operational disruptions, or legal liabilities. A newly enacted information privacy law that significantly increases financial penalties for breaches of personally identifiable information (PII) will most likely increase the impact of a loss event for an organization affected by the new law, because it will increase the potential cost and severity of a data breach involving PII. The other options are not as likely as an increase in loss event impact, because they do not directly result from the new law, but rather depend on other factors, such as the organization’s risk management capabilities, as explained below:

A. Increase in compliance breaches is not a likely outcome, because it assumes that the organization will not comply with the new law, which would expose it to more risks and penalties. A rational organization would try to comply with the new law by implementing appropriate controls and measures to protect PII and prevent data breaches.

C. Increase in residual risk is not a likely outcome, because it assumes that the organization will not adjust its risk response strategies to account for the new law, which would leave it with more risk exposure than desired. A prudent organization would try to reduce its residual risk by enhancing its risk mitigation controls or transferring its risk to a third party, such as an insurance company.

D. Increase in customer complaints is not a likely outcome, because it assumes that the organization will experience more data breaches involving PII, which would affect its customer satisfaction and loyalty. A responsible organization would try to avoid data breaches by improving its security posture and practices, and by communicating transparently and effectively with its customers about the new law and its implications. References = Risk and Information Systems Control Study Manual, Chapter 2, Section 2.1.1, page 32.

A compliance-based CSA focuses on ensuring that the business unit follows the policies and procedures established by the enterprise, regardless of the actual risk level or impact of the controls.

A risk-based CSA focuses on identifying and evaluating the risks that may affect the business unit’s objectives, and designing and implementing controls that are appropriate to mitigate those risks.

A compliance-based CSA may not capture all the high-risk issues that exist in a business unit, especially if they are not aligned with the enterprise’s standards or expectations.

A risk-based CSA may identify more high-risk issues than a compliance-based CSA, because it considers both internal and external factors that may affect the business unit’s performance or security.

Therefore, a difference in results between a previous control self-assessment (CSA) and an audit indicates that either one of them was not risk-based, but rather compliance-based.

The references for this answer are:

Risk IT Framework, page 9

Information Technology & Security, page 3

Risk Scenarios Starter Pack, page 1

 The performance of a client-facing application is the measure of how well the application meets the expectations and requirements of the clients who use it. The performance of a client-facing application can be affected by various factors, such as functionality, usability, reliability, availability, security, and scalability. Continuously monitoring the performance of a client-facing application is the process of collecting, analyzing, and reporting on the performance data and metrics of the application over time. Continuously monitoring the performance of a client-facing application can help identify and resolve issues, improve quality, optimize resources, and enhance client satisfaction. The most important thing to ensure when continuously monitoring the performance of a client-facing application is that the objectives are confirmed with the business owner. The business owner is the person or entity who has the authority and responsibility for the business value and outcomes of the application. The business owner defines the objectives, goals, and requirements of the application, and sets the performance criteria and targets. Confirming the objectives with the business owner can help ensure that the performance monitoring is aligned with the business needs and expectations, and that the performance data and metrics are relevant, accurate, and meaningful. References = Risk and Information Systems Control Study Manual, Chapter 4: Risk and Control Monitoring and Reporting, Section 4.3: Continuous Monitoring, p. 203-205.