CRISC: Certified in Risk and Information Systems ControlDemo

Question

Under the three lines of defense model, which of the following activities would be performed by the FIRST line of defense?

A A risk practitioner executes an annual assessment of key controls that impact financial statements
B Internal control activities are reviewed monthly by a risk management committee
C Control owners review a monthly report on the operation of high-risk controls
D Internal audit reviews high-risk areas to ensure controls are executed in a timely manner

Explanation

The first line of defense consists of operational management and control owners, who own and manage risks and are responsible for the day-to-day operation and monitoring of controls. Reviewing the monthly operation report for high-risk controls is therefore a first-line responsibility.

CRISC: Certified in Risk and Information Systems ControlDemo

AstroTutor

Notes

Readiness

QuestionQ1521

Community Discussion