CRISC: Certified in Risk and Information Systems Control

By Isaca · Question Mode

QuestionQ71

VerifiedRisk Assessment

A risk practitioner has implemented a key risk indicator (KRI) that issues a warning when the number of untreated IT control deficiencies exceeds a specified threshold. Which of the following is the GREATEST concern with this KRI’s design?

Explanation

A KRI should reflect meaningful risk exposure. Counting untreated IT control deficiencies without considering their severity or significance can obscure critical deficiencies and overemphasize minor ones, making the indicator a poor measure of actual risk.

Community Discussion

No comments yet. Be the first to start the discussion!