Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified in Risk and Information Systems Control · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
The BEST recommendation is option B, Discuss risk mitigation options with the risk owner. By discussing the issue with the risk owner, the control owner can work collaboratively to identify and assess the risks associated with the deteriorated control, determine the appropriate course of action to mitigate the risks, and implement a plan to address the issue. This recommendation provides the opportunity for the control owner to address the issue in a timely and efficient manner without involving senior management or implementing compensating controls unnecessarily.
B. Discuss risk mitigation options with the risk owner. The best recommendation to the control owner when they state that an existing control has deteriorated over time is to discuss risk mitigation options with the risk owner. This course of action involves collaborating with the individual or team responsible for managing the risk associated with the deteriorated control. By discussing the issue with the risk owner, they can work together to identify potential solutions or alternative controls that can help address the situation effectively. Option B reflects a proactive approach to addressing the control deterioration, focusing on identifying solutions to mitigate the risk. While the other options might be relevant in certain situations, discussing risk mitigation options with the risk owner is the most direct and constructive way to address the control's deterioration.
If the CO for a DOOR finds out the key has been copied, thus out of hands for too many persons. Will CO install another lock for the door OR will discuss with RO first about the options? If the control is needed, RO wouldnt care how CO takes care of it. HOWEVER, CO will not know that, THUS first CO should check with RO about the actual need for mitigation.