CRISC: Certified in Risk and Information Systems ControlDemo

Question

When implementing an IT risk management program, at which of the following times is it BEST to evaluate the effectiveness of current controls?

A Before defining a framework
B During the risk assessment
C When evaluating risk response
D When updating the risk register

Explanation

Current control effectiveness must be evaluated during the risk assessment because existing controls affect the likelihood and impact of a risk scenario, and therefore its residual risk. That assessment informs the subsequent choice of risk response and related risk-register updates.

Learn more

Using Risk Assessment to Support Decision Making

CRISC: Certified in Risk and Information Systems ControlDemo

AstroTutor

Notes

Readiness

QuestionQ1619

Community Discussion