Isaca Updated CRISC Exam Questions and Answers by husna

A conflict of interest is a situation where a person’s personal or professional interests may interfere with their ability to act in the best interest of the organization or the project1. A conflict of interest can compromise the integrity, objectivity, and impartiality of the person, and create ethical or legal issues for the organization or the project2. In the context of due diligence, a conflict of interest can affect the quality and reliability of the information and analysis, and jeopardize the success and confidentiality of the acquisition3.

The best course of action for a member of the due diligence team who realizes a close acquaintance is a high-ranking IT professional at a subsidiary of the company about to be acquired is to disclose potential conflicts of interest. This means that the team member should inform the due diligence leader and the organization’s management about the relationship with the acquaintance, and explain how it may affect their role or responsibility in the due diligence process. By disclosing potential conflicts of interest, the team member can:

Demonstrate honesty and transparency, and uphold the ethical standards and values of the organization and the project4.

Enable the due diligence leader and the organization’s management to assess the situation and decide the appropriate course of action, such as reassigning the team member, implementing additional controls or safeguards, or obtaining consent or approval from the relevant parties5.

Avoid or minimize the negative consequences or risks that may arise from the conflict of interest, such as legal liability, reputational damage, or loss of trust and credibility6.

References =

Conflict of Interest - CIO Wiki

What is a Conflict of Interest? Give Me Some Examples - The Balance Careers

How to Avoid Conflicts of Interest in M & A Transactions - DealRoom

How to Handle Conflicts of Interest - Harvard Business Review

Conflict of Interest Policy - ISACA

Managing Conflicts of Interest in the Public Sector Toolkit - OECD

Classifying information assets is a process of identifying and categorizing the data and information resources that are owned, controlled, or used by an organization, based on their value, sensitivity, and criticality.

Classifying information assets helps to determine the appropriate level of control that is needed to protect them from unauthorized access, use, disclosure, modification, or destruction. Control level refers to the degree of protection or assurance that a control provides against a risk.

Classifying information assets also helps to communicate risk to senior management, assign risk ownership, and facilitate internal audit. These are other benefits of risk management that are not directly related to determining the appropriate level of control.

The references for this answer are:

Risk IT Framework, page 11

Information Technology & Security, page 5

Risk Scenarios Starter Pack, page 3

The next step for the risk practitioner when a key external technology supplier refuses to provide control design and effectiveness information is to review the supplier’s contractual obligations. The contract between the organization and the supplier should specify the terms and conditions for the provision of the service or function, including the requirements for control design and effectiveness information. By reviewing the contract, the risk practitioner can determine if the supplier is breaching the contract and take appropriate actions to enforce the contract or terminate the relationship. Escalating the non-cooperation to management, excluding applicable controls from the assessment, and requesting risk acceptance from the business process owner are other possible steps, but they are not as effective as reviewing the supplier’s contractual obligations. References = ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, question 11; CRISC Review Manual, 6th Edition, page 144.

According to theISACA CRISC Review Manual, thedata classification processidentifies data sensitivity, criticality, and required protection levels.

“The level of protection for data should be based on its classification — i.e., the value of the information to the enterprise, its confidentiality, integrity, and availability requirements.”

Once classification (e.g., confidential, internal, public) is determined, corresponding safeguards (encryption, access control, backup policies) can be appropriately applied.

AandBare broad organizational factors.

C(access requirements) relates to functionality, not classification-based protection.

Therefore,D. Data classificationis correct.

CRISC Reference:Domain 3 – Risk Response and Mitigation, Topic: Information Asset Protection.