Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified in Risk and Information Systems Control · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Wasn't sure which is more key between A and D, but I'm more inclined towards A. D represents a flaw in metric monitoring, meaning risks might be missed in the future. However, an unassigned existing audit finding means a confirmed, known risk is already being ignored.
A. Ownership of an audit finding has not been assigned Not assigning ownership to an audit finding can lead to a lack of accountability for resolving the issue. When ownership is not clearly defined, it becomes less likely that the issue will be addressed in a timely and effective manner. Other options listed, while potentially concerning, do not hold the same immediate implications for the risk management process and the ongoing security of the organization. Hence, this should be of most concern for the risk practitioner.
Why we dropped "B" and "D", they are mapped to data center risk profile. The answers focused on the audit methodology/procedures and discarded the risk management perspectives. From my point of view the best answer is "B" then "D"