CRISC: Certified in Risk and Information Systems ControlDemo

Question

Which of the following is primarily a first-line-of-defense responsibility for risk management?

A Implementing risk treatment plans
B Conducting independent reviews of risk assessment results
C Establishing risk policies and standards
D Validating the status of risk mitigation efforts

Explanation

The first line of defense owns and manages risk in day-to-day operations, including executing risk responses and implementing risk treatment plans. Independent review, policy and standards development, and validation are generally oversight or assurance responsibilities.

CRISC: Certified in Risk and Information Systems ControlDemo

AstroTutor

Notes

Readiness

QuestionQ849

Community Discussion