Isaca Updated CRISC Exam Questions and Answers by dania

The three lines of defense model is a framework that describes the roles and responsibilities of different functions in an organization for managing risks and controls.

The first line of defense is the operational management, which is responsible for implementing and maintaining effective controls, identifying and assessing risks, and reporting on risk and control performance.

The second line of defense is the risk management and compliance functions, which are responsible for establishing and overseeing the risk management framework, providing guidance and support to the operational management, and monitoring and reporting on risk and compliance issues.

The third line of defense is the internal audit function, which is responsible for providing independent and objective assurance on the adequacy and effectiveness of the risk management and control system, and recommending improvements.

Within the three lines of defense model, the accountability for the system of internal control resides with the chief information officer (CIO). The CIO is the senior executive who oversees the IT function of the organization, and is responsible for ensuring that the IT risks and controls are aligned with the business objectives and strategies, and are integrated with the enterprise risk management and governance processes.

The references for this answer are:

Risk IT Framework, page 20

Information Technology & Security, page 14

Risk Scenarios Starter Pack, page 12

Corrective controlsare designed to correct errors or deviations after they occur. If failed changes frequently require re-implementation, this means corrective measures (e.g., testing, change rollback, error correction) are not functioning effectively.

CRISC guidance defines:

Preventive controls: stop incidents from occurring.

Detective controls: identify incidents when they occur.

Corrective controls: restore systems or data after incidents occur.

An increasing KPI (failed changes) means thecorrective mechanism is weak, henceCis the correct answer.

CRISC Reference:Domain 4 – Risk and Control Monitoring, Topic: Control Effectiveness Evaluation.

A cause-and-effect diagram, also known as a fishbone diagram or an Ishikawa diagram, is a graphical tool that helps to identify and analyze the potential causes and effects of a problem or an event. A cause-and-effect diagram can be used to develop technical risk scenarios related to a recently developed ERP system, because it can help to:

Break down the complex problem or event into manageable and measurable categories and subcategories of causes and effects

Visualize the relationships and interactions among the various factors that contribute to the problem or event

Identify the root causes and the most significant effects of the problem or event

Generate ideas and hypotheses for testing and validating the problem or event

Communicate and present the problem or event clearly and logically to the stakeholders1

A cause-and-effect diagram can be constructed by following these steps:

Define the problem or event and write it in a box on the right side of the diagram

Draw a horizontal line from the box to the left side of the diagram, representing the main spine of the fishbone

Identify the major categories of causes that affect the problem or event, such as people, process, technology, environment, etc., and write them on the branches of the spine

For each category, brainstorm and list the possible subcategories and specific causes that influence the problem or event, and write them on the sub-branches of the spine

For each cause, identify and list the possible effects or consequences that result from the problem or event, and write them on the sub-sub-branches of the spine

Analyze the diagram and prioritize the causes and effects based on their frequency, severity, and controllability

Develop technical risk scenarios based on the most critical causes and effects, and describe how they could affect the ERP system and the organization1

The data custodian is the person who is responsible for implementing and maintaining security controls to protect the data entrusted to them by the data owner. The data custodian is typically a system administrator or a security systems administrator who has the technical skills and access rights to manage the security systems and processes that safeguard the data. The data custodian’s responsibilities include, but are not limited to: Installing, configuring, and updating security systems such as firewalls, anti-virus software, encryption tools, etc. Monitoring network trafficand system logs to detect and respond to security incidents. Conducting regular security assessments and audits to ensure compliance with security policies and standards. Implementing backup and recovery procedures to ensure data availability and integrity. The data custodian works under the direction and guidance of the data owner, who is the person who has the authority and accountability for the data and its use. The data owner defines the data classification, the data retention period, and the data access rights and privileges. The data owner also approves any changes to the security controls or the data itself. The data owner is typically a senior manager or a business unit leader who has the business knowledge and responsibility for the data. References = Risk and Information Systems Control Study Manual, Chapter 1: IT Risk Identification, Section 1.3: Data Classification, pp. 11-131