Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified in Risk and Information Systems Control · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
In CRISC and ISACA frameworks, risk ownership is central to governance. When a compensating control is proposed, it must be approved by the risk owner, who is accountable for the risk.
Answer is B . The risk response plan should be updated after the risk owner approves the compensating control.
D. Update the risk response plan. When a control for mitigating risk in a key business area cannot be implemented immediately, the risk practitioner's best course of action is to update the risk response plan. This ensures that there is a documented plan in place to address the risk, even if the primary control cannot be implemented right away. The risk response plan should include details about the compensating control, its effectiveness, and the timeframe for implementing the primary control. This helps in maintaining visibility and accountability for the risk mitigation efforts. While recording the risk as accepted in the risk register may be necessary if the risk cannot be fully mitigated, updating the risk response plan is a more proactive approach to address the issue.