CRISC: Certified in Risk and Information Systems ControlDemo

Question

While reviewing the risk register, a risk practitioner identifies significant differences in inherent risk between business units for the same risk scenario. Which of the following is the BEST course of action?

A Request that both business units conduct another review of the risk.
B Review the assumptions of both risk scenarios to determine whether the variance is reasonable.
C Update the risk register with the average of residual risk for both business units.
D Update the risk register to ensure both risk scenarios have the highest residual risk.

Explanation

Inherent risk reflects the exposure before controls and may legitimately differ by business unit because their operating context, assets, processes, and threat exposure can vary. Reviewing each scenario’s assumptions establishes whether the differing ratings are justified before taking any corrective action.

CRISC: Certified in Risk and Information Systems ControlDemo

AstroTutor

Notes

Readiness

QuestionQ771

Community Discussion