CRISC Question 393

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose C1

  C. Cost-benefit analysis of automation. The primary consideration when assessing the automation of control monitoring should be "C. Cost-benefit analysis of automation." It's important to evaluate whether the benefits gained from automating control monitoring, such as increased efficiency, accuracy, and timeliness, outweigh the costs associated with implementing and maintaining the automation solution. This analysis helps organizations make informed decisions about whether automation is a viable and worthwhile option for monitoring controls. While the other options (frequency of failure of control, contingency plan for residual risk, impact due to failure of control) are also relevant factors to consider, the cost-benefit analysis is crucial in determining whether automation is a justifiable investment and aligns with the organization's overall risk management strategy and resource allocation.

• 1

  going with C since its not on the control rather on the monitoring of the control.

• Chose C2

  Agree with C. The question is about the automation of monitoring, not automation of the control. If you add automated monitoring without concern for cost, it can take the overall cost of the control over the cost of the impact.