CRISC: Certified in Risk and Information Systems ControlDemo

By Isaca · Question Mode

QuestionQ272

Risk Assessment

Which of the following should be done FIRST after a new risk scenario is identified?

  • A Assess the risk awareness program
  • B Assess the risk training program
  • C Identify the risk owner
  • D Estimate the residual risk
Explanation

A risk owner establishes accountability for evaluating the scenario, selecting and implementing treatment, monitoring it, and accepting any remaining risk. Residual risk can be estimated only after relevant controls have been considered.

Community Discussion

No comments yet. Be the first to start the discussion!