Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified in Risk and Information Systems Control · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
From the CRISC standpoint, the risk practitioner must verify that this has happened and that the risk is understood and owned.
there is a need to prove the findings
B. verify that applicable risk owners understand the risk When a control deficiency is identified, the primary responsibility of the risk practitioner is to ensure that the relevant risk owners are aware of and understand the implications of the deficiency. Only with this understanding can the risk owners make informed decisions about whether to address the risk and how to do so. Once the risk is understood, other actions such as performing follow-up assessments, implementing compensating controls, or recommending system changes can be considered.