CRISC Question 273

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B1

  The best way to validate whether controls have been implemented according to the risk mitigation action plan is to test the control design. Testing the control design involves examining the specific control activities that have been put in place and determining if they adequately address the identified risks as outlined in the action plan. This goes beyond simply reviewing documentation and looks at how controls operate in practice.

• Chose B1

  B. Test the control design. The best way to validate whether controls have been implemented according to the risk mitigation action plan is to test the control design. This involves assessing whether the controls that were designed and put in place are operating as intended and effectively mitigating the identified risks. Testing the control design ensures that the controls are properly configured and capable of addressing the specific risks they were designed to mitigate. While implementing key risk indicators (KRIs) and key performance indicators (KPIs) are valuable tools for monitoring and measuring the effectiveness of controls and risk management efforts, they are not specifically focused on validating the implementation of controls according to the risk mitigation action plan. Testing the control environment can also be part of the process, but testing the control design comes first to confirm that the controls are correctly established before assessing their ongoing effectiveness.

• Chose B1

  B. Test the control design Testing the control design ensures that the controls have been structured and set up in a manner that will effectively manage and mitigate the identified risks. This validation step is crucial to ascertain whether the controls have been implemented according to the risk mitigation action plan.