CRISC Exam Questions & Answers

Corporate culture is the set of values, beliefs, and norms that shape the behavior and attitude of an organization and its people. Corporate culture alignment is the degree of consistency and compatibility between the corporate culture and the organization's vision, mission, strategy, andobjectives. Corporate culture misalignment is the situation where the corporate culture is not aligned with the organization's goals and expectations, and may hinder or undermine the achievement of those goals. The acceptance of control costs that exceed risk exposure is most likely an example of corporate culture misalignment, as it indicates that the organization is not following a rational and optimal approach to risk management. The organization is spending more resources on controlling risks than the potential benefits or losses that the risks entail, which may result in inefficiency, waste, or opportunity cost. The organization may also be overemphasizing the importance of risk avoidance or mitigation, and neglecting the potential value creation or innovation that may arise from taking or accepting some risks. The other options are not the best answers, as they do not explain the situation of accepting control costs that exceed risk exposure. Low risk tolerance is the degree of variation from the risk appetite that the organization is not willing to accept. Low risk tolerance may lead to excessive or unnecessary controls, but it does not necessarily mean that the control costs exceed the riskexposure. High risk tolerance is the degree of variation from the risk appetite that the organization is willing to accept. High risk tolerance may lead to insufficient or ineffective controls, but it does not imply that the control costs exceed the risk exposure. Corporate culture alignment is the situation where the corporate culture is aligned with the organization's goals and expectations, and supports and facilitates the achievement of those goals.Corporate culture alignment would not result inaccepting control costs thatexceed risk exposure, as it would imply a balanced and rational approach to risk management.Reference:= CRISC Review Manual, pages 22-231; CRISC Review Questions, Answers & Explanations Manual, page 812

Avoidancemeans the risk is no longer relevant because the activity is not pursued. As a result, there isno residual riskto manage or control. ISACA's risk response options include avoidance, which eliminates the need for further risk treatment.

Testing is completed by IT support users without input from end users should be of most concern to a risk practitioner reviewing the system development life cycle (SDLC). This is because testing without input from end users can result in poor quality, usability, and functionality of the system, as well as increased errors, defects, and rework. Testing without input from end users can also lead to user dissatisfaction, resistance, and non-compliance, as well as misalignment with the business requirements and objectives. According to the CRISC Review Manual 2022, one of the key risk identification techniques for IT projects is to involve the end users and other relevant parties in the testing process1. According to the CRISC Review Questions, Answers & Explanations Manual 2022, testing without input from end users is the correct answer to this question2.

Testing in phases, overriding segregation of duties controls, and using data anonymization are not the most concerning issues for a risk practitioner reviewing the SDLC. These are possible practices or techniques that can be used in the testing process, but they do not necessarily pose significant risks or problems. Testing in phases can help ensure that the system meets the technical and functional specifications, as well as the user acceptance criteria, at each stage of the development. Overriding segregation of duties controls can be justified and authorized during the testing phases, as long as the controls are restored and verified before the system goes live. Using data anonymization can help protect the privacy and security of the data used in the testing process, as well as comply with the relevant regulations and standards.

Inherent risk is the most likely to increase as a result of the new initiative, because it is the risk that exists before any controls or mitigating factors are applied. Inherent risk reflects the natural or raw level of exposure that the organization faces from a given risk source or scenario. Accepting credit card payments from customers via the corporate website introduces new sources and types of risk, such as fraud, theft, data breach, or non-compliance, that increase the inherent risk level of the organization. Risk tolerance, risk appetite, and residual risk are all related to the risk management process, but they are not the most likely to increase as a result of the new initiative, as they depend on the organization's risk strategy, objectives, and controls. Reference: = Risk and Information Systems Control Study Manual, Chapter 2, Section 2.3.1, page 51