CRISC: Certified in Risk and Information Systems ControlDemo

Question

A risk practitioner identifies a deficiency in a critical system that cannot be patched. Which of the following should be the risk practitioner’s FIRST action?

A Submit a request to change management.
B Report the issue to internal audit.
C Review the business impact assessment.
D Conduct a risk assessment.

Explanation

A risk assessment establishes the specific risk posed by the unpatchable deficiency by evaluating its likelihood and business impact, as well as existing controls and appropriate treatment options. This assessment provides the basis for any subsequent compensating-control change or risk escalation.

CRISC: Certified in Risk and Information Systems ControlDemo

AstroTutor

Notes

Readiness

QuestionQ1003

Community Discussion