CRISC: Certified in Risk and Information Systems ControlDemo

By Isaca · Question Mode

QuestionQ220

Risk Response and Reporting

A control owner has chosen to implement a compensating control rather than the control selected in the risk action plan. After reassessing the risk, which action is MOST important for the risk practitioner?

  • A Notify senior management of the control owner's decision.
  • B Seek approval of the change from the risk owner.
  • C Update control ownership in the risk register.
  • D Update policies relevant to the risk.
Explanation

The risk owner is accountable for risk-based decisions and for selecting a response that brings residual risk within the organization’s accepted tolerance. Replacing a planned control with a compensating control changes the risk treatment, so the risk owner must approve that change after the reassessment.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!