Full Access Isaca CRISC Tutorials

A decision tree is a technique that can be used during a risk assessment to demonstrate to stakeholders that all known alternatives were evaluated. A decision tree is a graphical tool that shows the possible outcomes and consequences of different choices or actions in a sequential and hierarchical manner. A decision tree can help to compare and contrast the alternatives based on their expected values, costs, benefits, and risks, as well as to identify the optimal or preferred alternative that maximizes the value or minimizes the risk. A decision tree can also help to communicate and explain the rationale and assumptions behind the decision-making process to the stakeholders. The other options are not the best techniques to demonstrate to stakeholders that all known alternatives were evaluated, although they may be useful and complementary. A control chart is a technique that monitors the performance and quality of a process or activity over time by plotting the data points and the control limits. A control chart can help to detect and analyze the variations or deviations from the expected or desired results, as well as to identify and correct the causes or sources of the variations. A sensitivity analysis is a technique that measures the impact of changes in one or more variables or parameters on the outcome or result of a model or a system. A sensitivity analysis can help to assess the uncertainty or variability of the outcome or result, as well as to determine the most influential or critical variables or parameters that affect the outcome or result. A trend analysis is a technique that examines the patterns or movements of data or information over time by using statistical or graphical methods. A trend analysis can help to forecast or predict the future behavior or direction of the data or information, as well as to identify and explain the factors or drivers that influence the data or information. References = CRISC Review Manual, pages 38-391; CRISC Review Questions, Answers & Explanations Manual, page 922; Risk Assessment and Analysis Methods: Qualitative and Quantitative - ISACA3; Risk Assessment: Process, Examples, & Tools | SafetyCulture4

A risk assessment of a production system is a process of identifying, analyzing, evaluating, and treating the risks that may affect the performance, quality, or safety of the production system, which is a system that transforms inputs into outputs using various resources, processes, and technologies12.

The most appropriate action for the risk manager to take after undertaking a risk assessment of a production system is to inform the process owner of the concerns and propose measures to reduce them, which is a process of communicating and consulting with the person who is responsible for the design, operation, and improvement of the production system, and suggesting possible risk responses that can prevent, mitigate, transfer, or accept the risks34.

This action is the most appropriate because it ensures the involvement and collaboration of the process owner, who has the authority and accountability to implement and monitor the risk responses, and who can provide feedback and input on the feasibility and effectiveness of the proposed measures34.

This action is also the most appropriate because it supports the risk management process and objectives, which are to identify and address the risks that may affect the achievement of the organization’s goals and the delivery of value to the stakeholders34.

The other options are not the most appropriate actions, but rather possible alternatives or supplements that may have some limitations or drawbacks. For example:

Recommending a program that minimizes the concerns of the production system is an action that involves designing and planning a set of coordinated and interrelated activities and tasks that aim to reduce the likelihood or impact of the risks34. However, this action is not the most appropriate because it does not involve the process owner, who is the key stakeholder and decision maker for the production system, and who may have different views or preferences on the risk responses34.

Informing the development team of the concerns, and together formulating risk reduction measures is an action that involves communicating and consulting with the group of people who are responsible for creating, testing, and deploying the products or services that are produced by the production system, and jointly developing possible risk responses34. However, this action is not the most appropriate because it does not involve the process owner, who is the primary owner and user of the production system, and who may have different needs or expectations on the risk responses34.

Informing the IT manager of the concerns and proposing measures to reduce them is an action that involves communicating and consulting with the person who is responsible for managing and overseeing the IT resources, processes, and systems that support the production system, and suggesting possible risk responses34. However, this action is not the most appropriate because it does not involve the process owner, who is the main stakeholder and beneficiary of the production system, and who may have different requirements or constraints on the risk responses34. References =

1: Risk Assessment for the Production Process1

2: Risk Assessment for Industrial Equipment2

3: Risk IT Framework, ISACA, 2009

4: IT Risk Management Framework, University of Toronto, 2017

New risk exposures due to changes in the business environment are the possibilities and impacts of new or emerging threats or opportunities that may affect the organization’s objectives, performance, or value creation, as a result of changes in the internal or external factors that influence the organization’s operations, such as technology, competition, regulation, or customer behavior12.

The most helpful tool in identifying new risk exposures due to changes in the business environment is a SWOT analysis, which is a technique that involves identifying and analyzing the strengths, weaknesses, opportunities, and threats (SWOT) that are relevant to the organization’s situation, goals, and capabilities34.

A SWOT analysis is the most helpful tool because it helps the organization to scan and assess the business environment, and to identify and prioritize the new or emerging risk exposures that may arise from the changes in the environment34.

A SWOT analysis is also the most helpful tool because it helps the organization to align and adapt its strategy and actions to the changes in the environment, and to leverage its strengths and opportunities, and mitigate its weaknesses and threats34.

The other options are not the most helpful tools, but rather possible sources or inputs that may be used in a SWOT analysis. For example:

Standard operating procedures are documents that describe the routine tasks and processes that are performed by the organization, and the policies and standards that govern them56. However, these documents are not the most helpful tools because they may not reflect or capture the changes in the business environment, and they may need to be revised or updated to address the new or emerging risk exposures56.

Industry benchmarking is a technique that involves comparing and contrasting the performance and practices of the organization with those of the similar or leading organizations in the same or related industry, and identifying the gaps or opportunities for improvement78. However, this technique is not the most helpful tool because it may not provide a comprehensive or holistic view of the business environment, and it may not align with the organization’s specific situation, goals, or capabilities78.

Control gap analysis is a technique that involves assessing and evaluating the adequacy and effectiveness of the controls that are designed and implemented to mitigate the risks, and identifying and addressing the areas or aspects that need to be improved or added . However, this technique is not the most helpful tool because it is reactive rather than proactive, and it may not identify or anticipate the new or emerging risk exposures that may result from the changes in the business environment . References =

1: Risk IT Framework, ISACA, 2009

2: IT Risk Management Framework, University of Toronto, 2017

3: SWOT Analysis - ISACA1

4: SWOT Analysis: What It Is and When to Use It2

5: Standard Operating Procedure - Wikipedia3

6: How to Write Effective Standard Operating Procedures (SOP)4

7: Benchmarking - Wikipedia5

8: Benchmarking: Definition, Types, Process, Advantages & Examples6

: Control Gap Analysis - ISACA7

: Control Gap Analysis: A Step-by-Step Guide8

According to the CRISC Review Manual (Digital Version), the best way to validate the results of a vulnerability assessment is to perform a penetration test, which is a type of security testing that simulates an attack on the IT assets and processes to exploit the identified vulnerabilities and evaluate the potential impact and severity of the attack. Performing a penetration test helps to:

Confirm the existence and exploitability of the vulnerabilities detected by the vulnerability assessment

Measure the effectiveness and efficiency of the existing security controls and countermeasures

Identify and prioritize the risks and gaps in the security posture of the IT assets and processes

Recommend and implement appropriate remediation and mitigation actions to address the vulnerabilities and risks

Enhance the security awareness and resilience of the organization

References = CRISC Review Manual (Digital Version), Chapter 1: IT Risk Identification, Section 1.5: IT Risk Identification Methods and Techniques, pp. 36-371