Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified in Risk and Information Systems Control · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Believe it is A.
Review and correct, reason: Internal and external risk reports should be the primary input when designing IT controls. These reports help identify the potential risks that may affect the organization's IT environment and provide insight into the types of controls that can be implemented to mitigate those risks. Control self-assessments can also provide valuable information, but they are typically more focused on evaluating the effectiveness of existing controls rather than designing new controls.
When designing controls, the first step is to understand the current control environment, through mechanisms such as control self-testing.