Isaca CRISC Online Access

The greatest concern of maintaining independent departmental risk registers that are not automatically aggregated is that management may be unable to accurately evaluate the risk profile. The risk profile is the overall view of the risks that the organization faces and their impact on the organization’s objectives. It helps management to prioritize and allocate resources for risk management and to align the risk appetite and strategy. If the departmental risk registers are not aggregated, management may not have a complete and consistent picture of the risks across the organization. They may miss some important risks, overestimate or underestimate some risks, or have conflicting or redundant risk information. This may lead to poor risk management decisions and outcomes. The other options are also concerns, but they are not as critical as the inability to evaluate the risk profile. References = Risk and Information Systems Control Study Manual, Chapter 2: IT Risk Assessment, Section 2.2: IT Risk Analysis, page 63.

Risk exposure is the product of risk likelihood and risk impact ratings. It represents the potential loss or damage that may result from a risk event. After implementing countermeasures, the risk likelihood and/or impact ratings may change, depending on the effectiveness of the countermeasures. Therefore, the risk exposure must also change to reflect the updated risk ratings. The other components of the register, such as risk owner, risk impact rating, and risk likelihood rating, may or may not change depending on the nature and scope of the countermeasures. References = Risk and Information Systems Control Study Manual, Chapter 2: IT Risk Assessment, Section 2.4: IT Risk Response, page 87.

 Understanding vulnerabilities associated with the use of the assets is the primary reason for a risk practitioner to review an organization’s IT asset inventory, as it helps to identify and assess the potential threats and risks to the assets. The other options are not the primary reasons for a risk practitioner to review an organization’s IT asset inventory, although they may be related to the process.

The greatest concern for a risk practitioner with the use of a vulnerability scanning tool is the inaccurate reporting of results. A vulnerability scanning tool is a software that scans the network or system for known vulnerabilities and generates a report of the findings. However, the tool may produce false positives (reporting vulnerabilities that do not exist) or false negatives (missing vulnerabilities that do exist). This can lead to incorrect risk assessment, ineffective risk response, and wasted resources. Increased time to remediate vulnerabilities, increased number of vulnerabilities, and network performance degradation are other possible concerns, but they are not as critical as the inaccurate reporting of results. References = ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, question 7; CRISC Review Manual, 6th Edition, page 202.