CRISC: Certified in Risk and Information Systems ControlDemo

By Isaca · Question Mode

QuestionQ776

Risk Assessment

A risk practitioner is asked to assess a new cloud-based service intended to improve an organization’s access-management capabilities. When is the BEST time for the risk practitioner to offer an opinion on control strength?

  • A After the initial design
  • B After a few weeks in use
  • C Before production rollout
  • D Before end-user testing
Explanation

The best time to assess control strength is after the initial design, when the proposed controls and their intended operation are defined but can still be adjusted efficiently before implementation and deployment.

Community Discussion

No comments yet. Be the first to start the discussion!