Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified in Risk and Information Systems Control · Isaca
Select 2 answers.
This question asks for 2 answers, but our data marks only 1. Compare with the community discussion below for the full answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Option analysis • A. Have capability to cure the risk events ✅ • Correct. Once an obscure risk occurs, the enterprise must have the ability to respond or mitigate it, otherwise identifying it alone isn’t enough. • B. Have capability to recognize an observed event as something wrong ✅ • Correct. You can’t manage a risk you don’t recognize. Detection and recognition are essential, especially for obscure or rare risks. • C. Have sufficient number of analysts ❌ • Not strictly required. While analysts help, the key requirement is capability, not the number of people. • D. Be in a position that it can observe anything going wrong ❌ • Ideal, but practically impossible. The requirement is to recognize risks that are observable, not literally “anything.”
Given answers are correct. Capability to Recognize an Event as Wrong: The enterprise must be able to identify anomalies or deviations from expected behavior to develop effective risk scenarios. Position to Observe Issues: The organization needs mechanisms and tools to monitor processes and environments so that potential risks can be spotted early. These capabilities ensure the enterprise is proactive and well-prepared to manage risks, even those that are obscure. Let me know if you'd like further clarification!