Isaca CRISC Online Access

The result of a control working as desired, but having an annual cost of maintenance that exceeds the expected annual loss exposure, is that the control is inefficient, as it implies that the control is not cost-effective or optimal, and may require a review or adjustment. The other options are not the correct results, as they do not reflect the performance or adequacy of the control, but rather the maturity, effectiveness, or optimization of the control, respectively. References = CRISC Review Manual, 7th Edition, page 154.

The risk practitioner’s best recommendation when one of an organization’s key IT systems cannot be patched because the patches interfere with critical business application functionalities is to identify additional mitigating controls, as they may reduce the likelihood or impact of the vulnerabilities being exploited, and align the residual risk with the risk tolerance and appetite of the organization. The other options are not the best recommendations, as they may not address the risk adequately, or may introduce unacceptable consequences, such as disrupting the business operations, changing the risk strategy, or accepting excessive risk. References = CRISC Review Manual, 7th Edition, page 111.

The primary concern when IT decides to develop an in-house replacement application for a critical business application is that the business process owner is not an active participant. The business process owner is the person who has the authority and responsibility for the business process that is supported by the application, and who understands the business requirements, objectives, and expectations of the application. The business process owner should be involved in all stages of the application development lifecycle, from planning, analysis, design, testing, implementation, to maintenance, to ensure that the application meets the business needs and delivers value. Without the active participation of the business process owner, the application development project may face risks such as scope creep, miscommunication, user dissatisfaction, poor quality, or failure.

References:

•ISACA, Auditing IT Risk Associated With Change Management and Application Development1

•ISACA, Auditing Applications, Part 12