Isaca Updated CRISC Exam Questions and Answers by macsen

Risk appetite is the amount and type of risk that an organization is willing to accept in pursuit of its objectives. Risk appetite provides the most important information to facilitate a risk response decision, because it reflects the organization’s risk tolerance, preferences, and expectations, which guide the selection and implementation of the risk response strategies. Risk appetite helps the organization to balance the potential benefits and costs of taking risks, and to align the risk management process with the organizational strategy and culture. The other options are not as important as risk appetite, because they do not indicate the organization’s desired level of risk exposure, but rather provide supplementary or partial information for the risk response decision, as explained below:

A. Audit findings are the results and recommendations of the internal or external audit activities that evaluate the effectiveness and efficiency of the organization’s governance, risk management, and control processes. Audit findings provide useful information to facilitate a risk response decision, because they can identify the gaps or weaknesses in the current risk response strategies, and suggest corrective actions or improvements. However, audit findings do not indicate the organization’s risk appetite, which is the basis for determining the optimal risk response strategies.

C. Key risk indicators (KRIs) are metrics that measure the impact and likelihood of the risks, and provide early warning signs of changes in the risk exposure. KRIs provide useful information to facilitate a risk response decision, because they can monitor and report the performance and effectiveness of the current risk response strategies, and trigger corrective actions or adjustments. However, KRIs do not indicate the organization’s risk appetite, which is the basis for determining the acceptable level of risk exposure and performance.

D. Industry best practices are the standards, norms, and expectations for risk management that are established and followed by the peers or competitors in the same industry or sector. Industry best practices provide useful information to facilitate a risk response decision, because they can benchmark and compare the organization’s risk response strategies with those of the leading or successful organizations, and identify areas for improvement or innovation. However, industry best practices do not indicate the organization’s risk appetite, which is the basis for determining the unique and customized risk response strategies that suit the organization’s needs and goals. References = Risk and Information Systems Control Study Manual, Chapter 2, Section 2.2.2, page 40. Risk Appetite: What It Is and How to Use It, Risk Appetite: How Hungry Are You?, Risk Appetite: The Strategic Balancing Act

The business owner should own the risk if the ERP and payroll system fail to operate as expected, because the business owner is ultimately responsible for the business processes and objectives that depend on the systems. The other options are not the risk owners, because:

Option B: The ERP administrator is responsible for the technical aspects of the ERP system, but not the payroll system or the business outcomes.

Option C: The project steering committee is responsible for overseeing the project of replacing the ERP system, but not the ongoing operation and maintenance of the systems or the business risks.

Option D: The IT project manager is responsible for managing the project of replacing the ERP system, but not the payroll system or the business risks. References = Risk and Information Systems Control Study Manual, 7th Edition, ISACA, 2020, p. 90.

 The effectiveness of an employee deprovisioning process can be measured by the number of days taken to remove access after staff separation dates, as this indicates how quickly and completely the organisation can revoke the privileges of former employees and reduce the risk of unauthorized access or data leakage. The number of days taken for IT to remove access after receipt of HR instructions is a measure of the efficiency of the IT department, but not the overall process. The number of termination requests processed per reporting period is a measure of the volume of the process, but not the quality or timeliness. The number of days taken for HR to provide instructions to IT after staff separation dates is a measure of the performance of the HR department, but not the entire process. References = Risk and Information Systems Control Study Manual, Chapter 4: Risk Response, page 152.

The most relevant information to include in a risk management strategy is the organizational goals, because they provide the direction and purpose for the risk management activities. A risk managementstrategy is a document that outlines the objectives, scope, approach, roles, and responsibilities for managing risks in an organization. A risk management strategy should align with the organizational goals, which are the desired outcomes or results that the organization wants to achieve. The organizational goals should be specific, measurable, achievable, relevant, and time-bound (SMART), and they should reflect the organization’s vision, mission, values, and strategy. By including the organizational goals in the risk management strategy, the risk practitioner can ensure that the risk management process supports and enables the achievement of the organizational goals. The risk practitioner can also use the organizational goals as a basis for identifying, assessing, prioritizing, and responding to the risks that may affect the organization’s performance and success. The risk practitioner can also monitor and measure the progress and effectiveness of the risk management process by comparing the actual results with the expected results based on the organizational goals. Therefore, the organizational goals are the most relevant information to include in a risk management strategy, as they provide the foundation and framework for the risk management process. References = Risk and Information Systems Control Study Manual, Chapter 1: IT Risk Identification, Section 1.1: IT Risk Management Strategy, pp. 3-61