CRISC Exam Dumps - Certified in Risk and Information Systems Control

Perform a Risk Assessment:

Immediate Action: The first step when discovering a non-compliant implementation is to understand the potential risks it poses to the organization. This involves identifying threats, vulnerabilities, and potential impacts of the non-fungible token (NFT) asset program.

Risk Identification and Evaluation: Assess the new program’s impact on the organization’s risk profile. Determine if it introduces significant security, compliance, or operational risks.

Documentation and Reporting: Document the findings and present them to senior management along with recommendations for mitigation or further action.

Comparison with Other Options:

Report the Infraction: Reporting is necessary but should follow the risk assessment to provide a clear understanding of the implications and necessary mitigations.

Conduct Risk Awareness Training: Training is preventive and should be part of a long-term strategy, not the immediate response to a specific incident.

Discontinue the Process: Discontinuing the process may be a necessary step after assessing the risk, but the assessment must come first to justify such an action.

Best Practices:

Comprehensive Risk Assessment: Ensure that the risk assessment covers all aspects, including financial, reputational, and regulatory risks.

Stakeholder Involvement: Involve relevant stakeholders in the assessment process to gather diverse perspectives and ensure a thorough evaluation.

Actionable Recommendations: Provide clear, actionable recommendations based on the risk assessment findings.

References:

CRISC Review Manual: Discusses the importance of performing risk assessments when new systems or processes are implemented without following established procedures.

ISACA Standards: Emphasize the need for a systematic approach to identifying and assessing risks introduced by new initiatives or changes within the organization.

Risk likelihood is most likely to be reassessed as a result of implementing a machine learning-based solution to monitor IT usage and analyze user behavior in an effort to detect internal fraud, as it may change the probability of fraud occurrence or detection, and affect the risk assessment and response. Risk culture, risk appetite, and risk capacity are not the most likely to be reassessed, as they are more stable and strategic aspects of risk management, and are not directly influenced by the implementation of a specific solution. References = CRISC Review Manual, 7th Edition, page 108.

Ensuring segregation of duties are implemented within key systems or processes is the best strategy employed by risk management to prevent internal fraud, because it reduces the opportunity for a single person to manipulate or misuse the system or process for fraudulent purposes. Segregation of duties is a control that assigns different roles and responsibilities to different individuals, such that no one person can perform all the steps of a transaction or process. Requiring control owners to conduct an annual control certification, conducting regular internal and external audits on the systems supporting financial reporting, and requiring the information security officer to review unresolved incidents are all useful strategies to detect or deter internal fraud, but they are not the best strategy to prevent it, as they do not directly address the root cause of fraud. References = Risk and Information Systems Control Study Manual, Chapter 5, Section 5.3.1, page 197

The primary reason to implement a formalized risk taxonomy is to reduce subjectivity in risk management, as it provides a common and consistent language and structure for identifying, classifying, and reporting risks, and facilitates the comparison and aggregation of risks across the organization. The other options are not the primary reasons, as they are more related to the outcomes, benefits, or drivers of risk management, respectively, rather than the reason for risk management. References = CRISC Review Manual, 7th Edition, page 100.

Reviewing the risk register change log is the best way for management to validate whether risk response activities have been completed, because it helps to track and monitor the changes and updates that have been made to the risk register, and to verify that the risk response activities have been implemented and closed. A risk register is a document that captures, identifies, assesses and tracks risk as part of the risk management process4. A risk register change log is a record that documents the date, description, and reason for each change or update that is made to the risk register. A risk response activity is an action or task that is performed to implement the chosen risk response strategy for a specific risk, such as avoid, transfer, mitigate, or accept. Reviewing the risk register change log is the best way, as it helps to ensure that the risk register is accurate and current, and that the risk response activities have been completed and reported. Reviewing evidence of risk acceptance, control effectiveness test results, and control design documentation are all possible ways to validate whether risk response activities have been completed, but they are not the best way, as they may not cover all the risk response activities, and they may not reflect the changes or updates in the risk register. References = Risk and Information Systems Control Study Manual, Chapter 3, Section 3.4.1, page 101

•A risk treatment plan is a document that describes the actions and resources needed to implement the chosen risk response strategy for each identified risk1. A risk response strategy is the way an organization decides to address a risk, such as avoiding, accepting, mitigating, or transferring it2.

•Sometimes, a risk treatment plan may not be completed on time due to various reasons, such as delays, resource constraints, technical issues, or changes in the risk environment. In such cases, the best approach is to implement compensating controls until the preferred action can be completed3.

•Compensating controls are alternative or additional controls that provide a similar level of assurance or protection as the original controls, when the latter are not feasible or sufficient3. Compensating controls can help to reduce the residual risk or maintain the risk within the acceptable level until the risk treatment plan is fully executed3.

•For example, if the risk treatment plan involves installing a firewall to protect the network from external threats, but the firewall is not available or compatible with the current system, a compensating control could be to use encryption, authentication, or monitoring tools to secure the network traffic until the firewall is installed3.

•Implementing compensating controls is better than the other options because it allows the organization to continue with the risk treatment plan while maintaining an adequate level of security and compliance. The other options are not advisable for the following reasons:

oReplacing the action owner with a more experienced individual (option A) may not solve the problem if the issue is not related to the action owner’s competence or performance. Moreover, replacing the action owner may cause disruption, confusion, or conflict in the risk management process.

oChanging the risk response strategy of the relevant risk to risk avoidance (option C) may not be possible or desirable if the risk is associated with a critical or beneficial activity or process. Risk avoidance means eliminating the source of the risk or discontinuing the activity that causes the risk2. This may result in losing opportunities, benefits, or value for the organization.

oDeveloping additional key risk indicators (KRIs) until the preferred action can be completed (option D) may not be effective or efficient if the existing KRIs are already sufficient to monitor and measure the risk. KRIs are metrics or data points that provide early warning signals or information about the level or trend of a risk456. Developing additional KRIs may not reduce the risk or improve the risk treatment plan, but may increase the complexity and cost of the risk management process.

References =

•Key Risk Indicators: Examples & Definitions - SolveXia

•Key Risk Indicators: A Practical Guide | SafetyCulture

•Complete Guide to Key Risk Indicators — RiskOptics

•Risk Response Plan in Project Management: Key Strategies & Tips

•Risk response strategies: mitigation, transfer, avoidance, acceptance - Twproject: project management software,resource management, time tracking, planning, Gantt, kanban

•Risk Response Strategies: A Guide to Navigating Uncertainty - Teamly

•Compensating Controls | Audit and Compliance | Pathlock

IT assets are the resources that support the organization’s business processes and objectives, such as hardware, software, data, and information. IT assets are the primary targets of IT risk, as they may be exposed to threats, vulnerabilities, and control deficiencies that could compromise their confidentiality, integrity, availability, or value. Therefore, identifying and classifying IT assets is the first step in developing relevant IT risk scenarios, as it helps to determine the scope, boundaries, and dependencies of the IT risk environment.

The other options are not the first things to review for identifying IT risk scenarios. Technology threats (A) are the potential sources of harm or damage to IT assets, such as natural disasters, cyberattacks, human errors, or sabotage. Technology threats are important to consider, but they are not the starting point for IT risk scenarios, as they depend on the context and characteristics of the IT assets. Security vulnerabilities © are the weaknesses or flaws in IT assets or controls that could be exploited by threats, such as outdated software, misconfigured systems, or insufficient encryption. Security vulnerabilities are also important to identify, but they are not the first thing to review, as they are specific to the IT assets and their configurations. IT risk register (D) is a document that records and tracks the identified IT risks, their analysis, evaluation, and response. IT risk register is a result of the IT risk assessment process, not an input to it.