Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified in Risk and Information Systems Control · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Should determine if its worth mitigate?
B. Relevance to the business process. The most important factor when deciding on a control to mitigate risk exposure is "B. Relevance to the business process." Controls should be selected based on their alignment with the specific risks and requirements of the business process in question. Controls that are directly applicable and tailored to the process have a higher likelihood of effectively mitigating the associated risk. While the other factors (comparison against best practice, regulatory compliance requirements, cost-benefit analysis) are also important considerations, they should be evaluated in the context of how well they align with the business process's unique characteristics and risk profile. Relevance to the business process ensures that the control is practical, applicable, and capable of effectively addressing the identified risk exposure.
I'd go with B, because assuming relevance for the CBA means B is a pre requisite and most important. But CRISC have a way of being silly so wouldn't shock me if D is right