CRISC: Certified in Risk and Information Systems ControlDemo

By Isaca · Question Mode

QuestionQ595

Risk Response and Reporting

What should a risk practitioner do first when an assessment identifies that a control is not operating as intended?

  • A Determine the root cause of the control issue.
  • B Recommend updates to the control procedures.
  • C Discuss the status with the control owner.
  • D Recommend compensating controls.
Explanation

The control owner has authority and accountability for control-related decisions and for ensuring that the control operates effectively. Discussing the status with that owner establishes the facts and appropriate ownership before investigating causes or recommending remediation. ISACA Interactive Glossary

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!