CRISC Question 306

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B2

  B. Conduct a gap analysis against compliance criteria. The best course of action when a risk assessment identifies that an organization may not be in compliance with industry regulations is to conduct a gap analysis against compliance criteria. A gap analysis involves comparing the organization's current practices, processes, and controls against the requirements of the relevant regulations. This approach helps identify areas where the organization falls short of compliance, enabling them to pinpoint specific gaps that need to be addressed. While all the other options (collaborating with management, identifying necessary controls, modifying internal assurance activities) can play roles in addressing compliance issues, conducting a gap analysis is a systematic and methodical way to understand the extent of the non-compliance and determine the specific areas that need attention. It provides a clear roadmap for bringing the organization into compliance.

• Chose B1

  You need to identify what, if anything, is not in compliance. B is the answer.

• 1

  echo B