CRISC Question 202

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• 1

  B. Key risk indicators (KRIs) would likely be the best approach to address this request. KRIs provide real-time or near-real-time insights into potential risks, allowing stakeholders to make informed decisions about resource allocation for risk mitigation. Using historical risk assessments or information from the risk register may not provide the most current and relevant data for decision-making. Additionally, while the cost associated with each control is important, it may not necessarily reflect the current risk profile or the effectiveness of mitigation efforts.

• Chose D1

  D. Information from the risk register A risk register is a comprehensive tool used in risk management that contains detailed information about identified risks, their assessment, and the measures planned or taken to address them. It typically includes information on the likelihood and impact of risks, as well as the status of any mitigation efforts. Using the risk register to generate department-specific IT risk profiles will provide a current and detailed view of the risks each department faces, along with the status of mitigation efforts. This information is crucial for making informed decisions about where to allocate resources effectively.

• 1

  B. Key risk indicators (KRIs) The best way to address the IT stakeholders' request for IT risk profile reports associated with specific departments to allocate resources for risk mitigation is to use key risk indicators (KRIs). KRIs are specific metrics or indicators that provide insight into the current level of risk exposure and the effectiveness of controls in place. By using KRIs, you can present quantifiable and measurable data that highlight the risk landscape of each department. This approach provides a more tangible and actionable basis for allocating resources and focusing mitigation efforts effectively.