Isaca Updated CRISC Exam Questions and Answers by macsen

The primary concern when IT decides to develop an in-house replacement application for a critical business application is that the business process owner is not an active participant. The business process owner is the person who has the authority and responsibility for the business process that is supported by the application, and who understands the business requirements, objectives, and expectations of the application. The business process owner should be involved in all stages of the application development lifecycle, from planning, analysis, design, testing, implementation, to maintenance, to ensure that the application meets the business needs and delivers value. Without the active participation of the business process owner, the application development project may face risks such as scope creep, miscommunication, user dissatisfaction, poor quality, or failure.

References:

•ISACA, Auditing IT Risk Associated With Change Management and Application Development1

•ISACA, Auditing Applications, Part 12

 The primary accountability for a control owner is to ensure the control operates effectively, as they have the authority and responsibility to design, implement, monitor, and report on the performance and adequacy of the control, and to identify and address any control gaps or deficiencies. Communicating risk to senior management, owning the associated risk the control is mitigating, and identifying and assessing control weaknesses are not the primary accountabilities, as they are more related to the roles and responsibilities of the risk owner, the risk practitioner, or the auditor, respectively, rather than the control owner. References = CRISC Review Manual, 7th Edition, page 101.

Local laws and regulations should be the primary consideration when assessing the risk of using IoT devices to collect and process PII, because they define the legal obligations and liabilities of the organization and the individuals involved. Non-compliance with local laws and regulations can result in fines, lawsuits, reputational damage, and loss of trust. Therefore, it is essential to understand and adhere to the applicable laws and regulations in the jurisdictions where the IoT devices operate and where the PII is stored, processed, and transferred.

References

•Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy Risks

•The Internet of Things (IoT) and Digitally Stored PII: Avoidable or Inevitable?

•Security Issues in IoT: Challenges and Countermeasures

Using a VPN ensures secure transmission of data over a public network by encrypting the communication channel, mitigating risks associated with data interception. This is consistent with Data Security Controls within the CRISC framework.