CRISC: Certified in Risk and Information Systems Control

By Isaca · Question Mode

QuestionQ26

VerifiedRisk Response and Reporting

What should be the primary objective of a risk practitioner conducting a post-implementation review of an IT risk mitigation project?

Explanation

The primary purpose is to confirm that the implemented controls or actions reduced risk to the intended level. Project completion, cost performance, and lessons learned are secondary measures that do not demonstrate risk-treatment effectiveness.

Community Discussion

No comments yet. Be the first to start the discussion!