CRISC Leak Questions

Assessing risk scenarios is the starting point when performing a risk analysis for an asset. A risk scenario is a description of a possible event or situation that could cause harm or loss to an asset. Assessing risk scenarios involves identifying the sources and causes of risk, the potential impacts and consequences of risk, and the likelihood and frequency of risk occurrence. Assessing risk scenarios can help establish the risk context, scope, and criteria for the asset, and provide the basis for further risk analysis steps, such as evaluating threats, assessing controls, and updating the risk register. According to the CRISC Review Manual 2022, assessing risk scenarios is the first step in the IT risk assessment process1. According to the CRISC Review Questions, Answers & Explanations Manual 2022, assessing risk scenarios is the correct answer to this question

Confirming that the risk has been mitigated to the intended level is paramount to ensure that the risk response was effective. This ties toRisk Mitigation and Treatment, ensuring that controls implemented have reduced the risk to within the organization's appetite. Updating registers or recalibrating tolerances comes secondary to verifying the effectiveness of mitigation.

 The most important information to include when reporting the effectiveness of risk management to senior management is the changes in residual risk levels against acceptable levels, as it indicates how well the risk management process and activities have reduced the risk exposure and impact to the level that is aligned with the risk tolerance and appetite of the organization. The other options are not the most important information, as they are more related to the drivers, factors, or outcomes of risk management, respectively, rather than the effectiveness or value of risk management. References = CRISC Review Manual, 7th Edition, page 109.

The risk practitioner’s first course of action when an assessment of information security controls has identified ineffective controls should be A. Determine whether the impact is outside the risk appetite1

According to the CRISC Review Manual, risk appetite is the amount and type of risk that an organization is willing to accept in pursuit of its objectives. Risk appetite reflects the organization’s risk culture, strategy, and values2

When an assessment of information security controls has identified ineffective controls, it means that the controls are not providing the expected level of protection or assurance for the information assets or processes. This may result in increased exposure or vulnerability to threats, or reduced ability to achieve objectives. Therefore, the risk practitioner should first determine whether the impact of the ineffective controls is outside the risk appetite, as this would indicate the need for urgent action or escalation3

The other options are not the first course of action when an assessment of information security controls has identified ineffective controls, because:

•B. Requesting a formal acceptance of risk from senior management may be appropriate if the impact of the ineffective controls is within the risk appetite, and the organization decides to accept the risk as it is. However, this should not be the first course of action, as it may not address the root cause of the ineffective controls, or the potential consequences or opportunities for improvement4

•C. Reporting the ineffective control for inclusion in the next audit report may be part of the risk communication and reporting process, but it should not be the first course of action, as it may delay the resolution or mitigation of the issue, or the implementation of corrective actions. Moreover, the next audit report may not be timely or relevant for the decision-makers or stakeholders who need to be informed of the ineffective controls5

•D. Deploying a compensating control to address the identified deficiencies may be a possible risk response option, but it should not be the first course of action, as it may require further analysis, evaluation, and approval. Moreover, deploying a compensating control may not be the most effective or efficient solution, as it may introduce additional complexity, cost, or risk.

1: CRISC Review Questions, Answers & Explanations Database, Question ID: 100003 2: CRISC Review Manual, 7th Edition, page 28 3: CRISC Review Manual, 7th Edition, page 223 4: CRISC Review Manual, 7th Edition, page 224 5: CRISC Review Manual, 7th Edition, page 225 : CRISC Review Manual, 7th Edition, page 226