CRISC: Certified in Risk and Information Systems ControlDemo

Question

Which of the following provides the STRONGEST indication that controls implemented under a risk action plan are ineffective?

A A security breach occurs.
B Internal audit identifies recurring exceptions.
C Changes are put into production without management approval.
D A sample is used to validate the action plan.

Explanation

Recurring exceptions identified by internal audit are repeated, independent evidence that the controls are not operating effectively or consistently. This indicates a systematic control weakness rather than an isolated event or a control-validation activity.

CRISC: Certified in Risk and Information Systems ControlDemo

AstroTutor

Notes

Readiness

QuestionQ1672

Community Discussion