CRISC: Certified in Risk and Information Systems ControlDemo

By Isaca · Question Mode

QuestionQ872

Governance

You are the risk professional at Bluewell Inc. A risk has been identified, and the enterprise wants to rapidly implement a control by applying a technical solution that deviates from the company’s policies. What should you do?

  • A Recommend against implementation because it violates the company's policies
  • B Recommend revision of the current policy
  • C Recommend a risk assessment and subsequent implementation only if residual risk is accepted
  • D Conduct a risk assessment and allow or disallow based on the outcome
Explanation

A policy exception should be supported by a risk assessment and implemented only when the resulting residual risk is formally accepted within the enterprise’s risk tolerance. Residual risk is the risk remaining after a risk response has been implemented.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!