CRISC Question 193

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A2

  A. External Audit: External audits are conducted by independent, third-party auditors. They are generally considered the most objective and reliable sources of information regarding the effectiveness of an organization's controls. External auditors are not influenced by internal biases and are expected to provide a thorough, impartial evaluation of the control environment. This makes their assessments highly valuable for evaluating residual risk.

• Chose A1

  A. External audit External audits are conducted by independent third parties and are typically more objective and thorough in evaluating an organization's control environment compared to internal audits or self-assessments. They provide a detailed and unbiased view of the effectiveness of the controls put in place by the vendor, thereby giving a clear picture of the residual risk. External auditors are not influenced by internal politics or biases, and their primary goal is to provide an accurate assessment of the organization's adherence to standards, regulations, and the effectiveness of its control environment.

• Chose A2

  A. External audit Among the assessments listed, the external audit conducted by a third party provides the most reliable input to evaluate residual risk in the vendor's control environment. External auditors are independent entities, separate from the organization being audited, and they adhere to standardized audit procedures and guidelines, ensuring objectivity and impartiality. Their focus on financial systems and processes also typically includes controls related to IT and security, especially if these systems and processes are reliant on IT.