Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CRISC > CRISC Domain 1 - A through H > Flashcards

CRISC Domain 1 - A through H Flashcards

Domain 1 - Riks Identification, Assessment and Evaluation

1
Q

Definition of Risk

A

Risk reflects the combination of the likelihood of events occuring and the impact those events have on the enterprise

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Risk contains

A
  • Opportunities for benefit (upside)

Threats to success (downside)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are the guiding principles for effective risk management

A
  • Maintain focus on the business mission, goals and objectives
  • Integrate IT risk mgt into enterprise risk mgt (ERM)
  • Balance the costs and benefits of manaing risk
  • Promote fair and open communication
  • Est tone at the top and assign personal accountability
  • Promote continuous improvement as part of daily activities
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Definition of Management

A
  • Mgmt entails the judicious use of means (resources, people, processes, practices, etc) to achieve an identified end
  • Often differentiated from governance as the distinction between being “committed” (governance) and “involved” (management)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Explain Management

A
  • Mgmt is responsible for execution within the direction set by the guiding body or unit
  • Mgmt is about planning, building, organizing and controlling operational activities to align with the direction set by the governance body
  • Mgmt is a means or instrument by which the governenace body achieves a result or objective
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Definination of Risk Mgmt

A

Risk Mgmt is the identification, assessment and prioritization of risk folled by coordinated and economical application of resources to minimize, monitor and control the probablility and/or impact of adverse evtnes or to maximize the realization of opportunities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Explain Responsibilities and Accountability for Risk Mgmt

A
  • Responsibilitiey belongs to those whom must ensure that the activities are completed successfully
  • Accountability applies to those individuals, groups, or entities that are ultimately responsible for the subject matter, process or scope
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Explain Risk Governance

A
  • Risk governance address the oversight of the business risk mgmt strategy of the enterprise
  • Risk governance is the domain of senior mgmt and the shareholders of the enterprise
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Who establishes and responsible for the risk governance? Explain

A
  • Senior mgmt and shareholders
  • They establish the enterprise’s risk culture and the acceptable levels of risk
  • They set up the mgmt framework
  • They ensure that the risk mgmt function is operating effectively to identify, manage, monitor, and report on current and potential risk facing the enterprise
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Define Governance

A
  • Governance is a system referring to all the means and mechanisms that enable multiple stakeholders in an enterprise to have an organized say in evaluating conditions and options
  • Setting direction
  • and monitoring compliance, performance and progress against plans to satisfy specific enterprise objectives
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Definition of Risk Governance

A
  • Risk governance is a strategic business function that ensures:
  • risk mgmt activieis align with the enterprise’s loss capacity
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are the objectives of risk governance

A
  1. Est and maintain a common risk view
  2. Integrate risk management into the enterprise
  3. Make risk-aware business decisions
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

To effectively govern enterpirse and IT risk there must be an:

A
  • Understanding and consensus with respoect to the risk appetite and risk tolerance of the enterprise
  • Awareness of risk and the need for effective communication about risk throughout the enterprise
  • Understanding of the elements of risk culture
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What’s the definition of risk appetite

A

The broad-based amount of risk that a company or entity is willing to accept in pursuit of its mission (or vision)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What’s the definiiion of risk tolerance

A

The acceptable variation relative to the achievement of an objective (often bbest measured in the same units as those used to measure the related objective)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are the major factors influencing risk appetitie

A
  • the enterprise’s objectrive capacitiy to obsorb lost, e.g., financial loss, reputation damage
  • The (management) culture or predispostion toward risk taking - cautious or agressive
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are the risk appetite bands and definitions

A

Really unacceptable - indicates really unacceptable risk. The enterprise est that this level of risk is far beyond its normal risk appetite. Any risk in this band may trigger an immediate risk response

  • Unacceptable - indicates elevated risk; also above acceptable risk appetite. The enterprise may, as a matter of policy, require mitigation or another edequate response to be defined within certain time boundaries
  • Acceptable - indicates a normal, acceptable level of risk, usually with no special action required, except for maintaining the current controls or other responses
  • Opportunity - indicates very low risk, in which cost-saving opportunities may be found by decreasing the degree of control or in which opportunities for assuming more risk may arise
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Define Risk Tolerance

A

The acceptable deviation from the level set by the risk appetite and business objectives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are the guidelines for risk appetite and risk tollerance

A
  • Risk appetite and risk tolerance must connect
  • Exceptions to risk tolerance stds must be reviewed and approved
  • Risk appetite and tolerance change over time
  • Cost of risk mitigation options can affect risk tolerance
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Definition of risk culture

A

The shared values and beliefs that govern the attitudes and behaviors toward risk taking, care and integrity, and determines how openly risk and losses are reported and discussed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Definition of Framework

A

A framework is a generally accepted, business-process-oriented structure that establishes a common language and enables repeatable business processes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Definition of Standard

A

A standard establishes mandatory rules, specifications, and metrics used to measure compliance against quality, value, etc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are standards intended for

A
  • Compliance purposes and to provide assurance to others who interact with a process or outputs of a process (e.g., food and drug qualilty)
  • To be implemented in a rigid way and to minimize the number of deviations based on a cost-benfit analysis.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

When should deviations from the standard be granted

A

Should only be granted on an “exception” basis and should follow a defined approval process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Definition of a Practice and Leading Practices

A
  • Practice is a frequent or usual action performed as an application of knowledge
  • Leading practice is defined as an action that optimally applies knowledge in a particular area
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Practices are issued by? and they may include

A
  • A recognized authority that is appropriate to the subject matter
  • Issuing bodies may include professional associations and academic institutions or commercial entities such as software vendors
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Why do frameworks, standards, and practices matter

A
  • Provide a systematic view of “things to watch” that could result in harm to customers or an enterprise
  • Act as a guide to focus efforts of diverse teams
  • Save time and costs, such as training costs, operational costs and performance improvement costs
  • Help achieve business objectives more quickly and easily
  • Provide creditiability to engatge functional (CFO) leadership
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is risk identification

A

The process of determining and documenting the risk that an enterprise faces

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is the identification of risk based on

A

The recognition of threats, vulnerabilities, assets and controls in the enterprise’s operational environment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is risk assessment

A

A process used to identify and evaluate risk and its potential effects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is risk evaluation

A

The process of comparing the estimated risk against given risk criteria to determine the significance of this risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Definition of Frequency

A

A measure of the rate by which events occur over a certain period of time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Definition of Magnitude

A

A mearus of the potential severity of loss or the potential gain from a realized IT event/scenario

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Definition of Risk Aggregation

A

The process of integrating risk assessments at a corporate level to obtain a complte view of the overall risk for the enterprise

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Definition of Risk Analysis

A

A process by which frequency and magnitude of IT risk scenarios are estimated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Definition of IT Risk

A

The business risk associated with the use, ownership, operation, involvement, influence and adoption of IT within an enterprise

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Effective risk identification, assessment and evaluation involves

A
  • Collecting data on:
  • The enterprise’s operating environment (internal/external)
  • Risk Events
  • Identifiying risk factors (internal/external)
  • Analyzing and estimating risk
  • Identifying business process resilience level, including the related IT services and supporting assets
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What are the three IT Risk Categories

A
  • IT benefit/value enablement risk
  • IT program and project delivery risk
  • IT operations and service deiivery risk
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Define IT benefit/value enablement risk

A

Associated with (missed) opportunities to use technology to improve efficiency or effectiveness of business proceses or as an enabler for new business initiatives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Define IT program and proejct delivery risk

A

Associated with the contribution of IT to new or improved business solutions, usually in the form or projects or programs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Define It operations and service delivery risk

A

Associated with the performance of IT systems and services, which can bring destruction or reduction of vlaue to the enterprise

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What are the high-evel phases of risk identification, assessment and evaluation

A
  1. Collect data
  2. Analyze Risk
  3. Maintain Risk Profile
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What are some methods used to collect risk data

A
  • Interviews
  • Questionnaires and surveys
  • Facilitated workshops
  • Observations
  • Testing
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Definition to Risk Scenario

A

A description of an event that can lead to a business impact, when, and if, it should occcur

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Risk scenario analysis is a technique used to

A
  • Describe risk in a more concrete and tangible manner

- Allow for proper risk assessment and analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What are the approaches to Risk Scenario Development? Explain each

A
  • Top-down approach: From the overall business objectives, an analysis of the most relevent and probable IT risk scenario impacting the business objectives is performed
  • Bottom-up approach: A list of generic scenarios is used to define a set of more concrete and customized scenarios, which are then applied to the individual enterprise situation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What drives the top-down risk scenario development approach and when is it most beneficial

A

Business objectives drives the approach; thus, the approach is unique to ea enterprise
-The approach is most beneficial in ensuring that the risk scenarios remain relevant and linked to real business risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

What benefit is it to use generic risk scenarios in Risk Scenario Development

A
  • Helps ensure that tno risk are overlooked

- Provides a comprehensive and complete view of IT risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

What are the steps in the bottom-up risk scenario development

A
  1. Using a list of generic risk scenarios, define a set of concrete risk scenarios for the enterprise
  2. Perform a vallidation against the business objectives of the entity
  3. Refine the selected scenarios based on this validation, and detail them to a level in line with the criticality of the entity
  4. Reduce the number of scenarios to a managable set
  5. Keep all risk factors in a register so that they can be reevaluated in the next iteration and included for detailed analysis if they have become relevant at that time
  6. Include in the scenarios an unspecified event - how to address an incident not covered by other scenarios
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

What are the Risk Scenario Components

A
  1. Actor
  2. Threat type
  3. Event
  4. Asset (tangible and intangible)
  5. Timing dimension
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

When should a Risk Assessment be performed

A

At least on an annual baiss or when important internal or external changes occur

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

What is a Risk Register and what does it record?

A
  • Also known as a risk log, it is a listing of all risks identified for the enterprise
  • It records:
  • All known risk
  • Priorities of risk
  • Likelihood of risk
  • Potential risk impact
  • Status of the risk mitigation plans
  • Contingency plans
  • Onwership of risk
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

What are the preequisites for developing a manageable set of risk scenarios

A
  • Organizational buy-in or support from enterprise entities and business lines, risk management, IT, finance, compliance and other parties
  • Expertise and experience to not overlook relevant scenarios and not be drawn into highly unrealistic or irrelevant scenarios
  • A thourough understanding of the environment
  • The involvement of all stakeholders
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

What is Systemic Risk

A

Something that happens with an important business partner that affects a larrge group of enterprises within an area or industry

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

What is Contagious Risk

A

Events that happen at several of the enterprise’s business partners within a very short time frame

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

What considerations must be required under Obscure or non-Historical Events

A
  • Visibility: Be in a postion that it can be observe anything going wrong
  • Recognition: Have the capability to recognize an observed event as something that is going wrong
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

Definition of Risk Factors

A

Those features that influence the likelihood and/or business impact of risk scenarios

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Name the Threats

A
  • Internal and External
  • intentional or accidental
  • Skilled or amateur
  • Motivated or curious
  • Natural or man-made,
  • Physical or related to equipment or utility failrures
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

Define External Risk factor

A

Those circumstances that can increase the likelihood or impact of an event and that are not always directly controllable by the enterprise

60
Q

Name the External Factors

A
  • Market/economy
  • Rate of change in the market
  • Competition
  • Geopolitical situation
  • Regulatory environment
  • Technology innovation and evolution
61
Q

Risk Assessment involves what two specific requirements

A
  • Risk Identification

- Risk Analysis

62
Q

What is Risk Monitoring

A

The process that systematically tracks and evaluates the performance of risk mitigation actions

63
Q

The Risk Management structure involves

A
  • Planning,
  • Assessment (identification-analysis),
  • Handling,
  • Monitoring and
  • Mitigation
64
Q

Threats are characterized as:

A

Those that are Imminent; those that are Emerging; those that are Consistent and those that are Persistent.

65
Q

What is Delphi

A

Is a security risk assessment and information gathering technique that uses the consensus of subject matter experts to determine mission risk

66
Q

Quantitative Risk Assessment is

A

A process used to analyze numerically the probability of each risk and its consequence on mission objectives.

67
Q

What techniques are used in Quantitative Risk Assessment

A

interviewing, sensitivity analysis, decision tree analysis, and simulation

68
Q

Qaulitative Risk Analysis is

A

the process of assessing the impact and likelihood of identified risks. What is the the probability and likelihood that the risk will occur and what is the consequence to mission objectives

69
Q

What are the NIST recommended steps for Risk Assessment Methodology

A
  1. System characterization
  2. Threat Identification
  3. Vulnerbility Identification
  4. Control Analysis
  5. Liklihood Determination
  6. Impact Analysis
  7. Risk Determination
  8. Control Recommendations
  9. Results Documentation
70
Q

What are the challenges of Qaulitative Risk Analysis

A
  • Subjectivity or bias in data collected
  • Overemphasis on minor events
  • Does not provide good data for cost-benefit analysis
  • Ranking levels may not be meaningful to data providers
71
Q

What are typical Qualitative RA Methods

A
  • Risk Control Self-assessment (RCSA)
  • Scorecards
  • Key risk indicators (KRI)
  • Liklihood impact matrix
  • Attribute analysis
  • Delphi forecasting
72
Q

Benefits of Quantitative Analysis

A
  • Allows for:
  • Data to be classified and counted
  • Statistical models to be contructed to explain what is being observed
  • Findings to be generalized to a larger population and direct comparison between two different data sets
  • Produces statically reliable results
  • Allows discovery of phenomena likely to be geniune vs merlely chance occurances
73
Q

Quantitative Analysis is

A

The use of numerical and statistical techniques to calculate liklihood and impact of risk

74
Q

Challenges of Quantitative Analysis

A
  • It is not always easy to collect data on ea and every process
  • Data may not be in the desired format or may not meet the needs of quant analysis
  • Reliable historical data are not always avail for analysis
  • Past data do not necessarily help predict future events (black swan phenom)
  • It is difficult to apply statistical models for events that happen infrequently
  • The cost is generally signficantly higher than the cost of qualitative analysis
75
Q

What are typical Quantitative RA Methods

A
  • Internal Loss Data
  • External Data
  • Business Process Modeling (BPM) and simulation
  • Statistical process control (SPC)
76
Q

Methods for Uncovering Less Obvious Risk Factors

A
  • Cause-and-Effect analysis
  • Fault Tree analyisis
  • Sensitivity analysis
77
Q

What is a key business continuity planning (BCP) activity that focuses on determining the impact of an event over time

A
  • Business Impact Analysis
78
Q

Definition of Business Impact Analysis

A

A specialized process to determine the impact of losing the support of any resource

79
Q

A BIA discovery process is meant to

A
  • Reveal the importance of a process and the potential impact that any disruption to that process would have on the enterprise
  • Est the escalation of loss over time
  • Answer questions about actual procedures, shortcuts, workarounds and the types of failures that may occur
80
Q

In BIA, when answering questions about actual procedures, shortcuts, workarounds and the types of failures that may occur. What does it involve

A
  • What the process does
  • Who performs the process
  • What the output is
  • The value of the process output to the enterprise
  • How the impact of the loss would escalate over time and at which point failure of the process might threaten the viability of the enterprise
81
Q

Proper execution of the BIA process entails what? What does it include?

A
  • Series of discovery exercises.
  • Includes: Asking questions that focus on identifying trigger events
  • Interviewing key personnel
  • Reviewing existing documentation
  • Collecting data by observiing business processes and personnel performing actual processes
  • Looking for existing workarounds and alternate procedures
82
Q

Using surveys in the BIA process can do what?

A

Raise issues of accuracy and consistency

83
Q

True or False: The data gathered during the BIA can be used later to guide the formulation of the risk response strategy

A

True

84
Q

What process verifies critical success factors (CSFs)

A

BIA

85
Q

The strategic importance of IT to the modern enterprise is seen through:

A
  • High investment
  • Pervaisiveness of IT
  • Relience on IT’s continuing operation
  • Impact caused when IT does not perform as expected
  • IT’s critical role in realizing efficiences
  • Ways in which IT enables business to take strategic action
86
Q

Why is monitoring and reporting on risk made difficult?

A

There is no shared language between those estimating the risk and those making risk response decisions

87
Q

What is critical for understanding where there are threats and vulnerabilities and where there are opportunities?

A

Clarity in defining the business impact (both positive and negative) of IT-related risk

88
Q

Definition of Risk as a derived value

A
  • Refers to the liklihood (or frequency) and magnitude of loss that exists from a combination of assets, threats, and control conditions
89
Q

Define Threat

A

An action or actor that/who may act in a manner that can result in loss or harm

90
Q

Define Vulnerability

A

A weakness in design, implementation, operation or internal control

91
Q

The adverse impact of a risk event can be described in terms of loss or degredation of any or a combination of the following three basic IT risk goals:

A
  • Integrity
  • Availability
  • Confidentiality
92
Q

Define Integrity

A

Relates to the accuracy and completeness of information and its validity in accordance with business values

93
Q

What IT risk goal refers to the requirement that information be protected from improper modification

A

-System and data integrity

94
Q

What is Loss of Integrity

A
  • Unauthorized changes are made to the data or information system by either intentional or accidental acts
95
Q

What’s the impact of Loss of Integrity

A
  • Continued use of the contaminated system or corrupted data may result in inaccuracy, fraud or erroneous decisions
  • Violation of integrity may be the firest step in a successful attack against system availability and confidentiality
96
Q

Define Availability

A

Relates to the information being accessible, when requiredby the business process, and also concerns the safegaurding of necessary resources and associated capabilities

97
Q

What is Loss of Availabiity

A

A mission critical IT system is unavailable to its end users and the enterprise’s objectives may be effected

98
Q

What is the impact of Loss of Availabiity

A

Loss of system functionality and operational effectiveness may result in loss of productive time, thus impeding the end user’s performance of their functions in supporting the enterprise’s objectives

99
Q

Define Confidentiality

A

Relates to the protection of information from unauthorized disclosure

100
Q

Data must be protected from improper disclosure depending on

A

The sensitivity of the data and associated legal requirements

101
Q

What is Loss of Confidentiality

A

Unauthorized disclosure of confidential or sensitive information

102
Q

What is the Impact of Loss of Confidentiality

A
  • Range from jeapordizing national security to the disclosure of data covered under the local privacy law
  • Unauthorized, unanticipated or unintentional disclosure of such information can result in loss of public confidence, loss of competative advantage, embarrassment or legal action agsint the enterprise
103
Q

Some tangible impacts of IT risk can be measured quantitatively as in:

A
  • Lost revenue
  • Cost of repariing the system
  • The level of effort required to correct problems caused by a successful threat action
104
Q

Business impact of IT-related risk in terms of High, Med, Low include:

A
  • Loss of public confidence
  • Loss of credibility
  • Damage to an enterprise’s interest
  • Impact on morale in the enterprise
105
Q

What is the key task related to risk assessment during the functional requirements definition phase? What will the level of risk associated with a system depend on?

A
  • To ensure that the risk associated with the system is identified
  • The criticality of the system (how important it is to suppor business ops) as well as the sensitivity (privacy) needs and criticality needs of the data being processed on the system
106
Q

What are the risks associated with Outsourcing? What is one risk the enterprise must be aware of? How can it protect itself?

A
  • Enterprise becomes reliant on another enterprise for its support
  • Risk related to privacy laws that may affect where data are stored and the need to protect sensitive data in transit, storage and processing from inadvertent or unauthorized disclosure
  • In many jurisdictions the responsibility for protection of data remains with the original enterprise, not the outsourcing firm
  • Ensure the security requirements and the proper audits are included in contracts
107
Q

IT projects are subject to risk of failure due to what factors?

A
  • Unrealistic delivery schedules or budget
  • Lack of skilled resources
  • Unclear or changing business reqs
  • Challenges with technology
  • Poor project mgmt
  • Resistence from users
108
Q

IT project failure may have an impact on BIA such as?

A
  • Loss of opportunity or market share
  • Inability to meet customer or regulatory demand
  • Lost revenue
  • Other tangible or intangible consequences
109
Q

What are the three broad risk factors to consider when planning a BPR project

A
  • Design risk
  • Implementation risk
  • Operation or rollout risk
110
Q

What are the risk types under BPR project Design Risk Area?

A
  • Sponsorship risk
  • Scope risk
  • Skill risk
  • Political risk
111
Q

What are the risk types under BPR project Implementation Risk Area?

A
  • Leadership risk
  • Technical risk
  • Transition risk
  • Personnel risk
  • Scope risk
112
Q

What are the risk types under BPR project Operation or Rollout Risk Area?

A
  • Management risk
  • Technical risk
  • Cultural risk
113
Q

What is the most effective way to achieve the highest return investment (ROI)?

A

Thinking big

114
Q

It is a design failure if what is excluded from the scope of change?

A
  • Politically sensitive process and existing jobs are excluded
115
Q

What are the Risk Components

A
  • Inherent risk
  • Residaul risk
  • Control risk
  • Detection risk
116
Q

What are the control types in Inherent Risk

A
  • Pervasive IT Controls

- Specific IT Controls

117
Q

Define Inherent Risk and provide an example? Is this risk ordinarilyt high, med. or low?

A
  • The risk level/exposure without taking controls or other management actions into account
  • Example: Inhernent risk associated with OS security is high due to changes to, or even disclosure of, data or programs through OS security weaknesses could result in system failure, security breach or regulatory penalties
  • Ordinarily high
118
Q

Define Residual Risk?

A

Risk that remains after managment has implemented a risk response

119
Q

Define Control Risk and provide an example? Is this risk ordinarilyt high, med. or low?

A
  • Risk of failure of the internal control systems to prevent, detect or correct an incident in a timely manner
  • Example: Control risk associated with manual reviews of computer logs can be high because activities requiring investigation are often easily missed due to the volume of logged information
  • Ordinarily low
120
Q

Define Detection Risk and provide an example?

A
  • Risk that the prescribed controls, substantive testing procedures, or monitoring will not detect an error that could be material, individually or in combination with other errors
  • Example: An IDS, an AV system, or FW is unable to detect or notice adverse conditions and trigger an adequate response
121
Q

What is it called when an IDS, AV system or FW is unable to detect or notice an adverse condition and trigger an adequate response?

A

A false-negative: An indication that everything is fine when there actually is a problem

122
Q

The calculation of risk for IT system is directly affected by?

A

The type of architecture the enterprise is using

123
Q

True/False: IT has the task of assisting in the managment of business risk?

A

True

124
Q

What is IT relied on and specifically for what domain?

A
  • Relied on for advanced risk analytics and reporting in the domain of Risk Mgmt Information Systems (RMIS)
125
Q

An Enterprise Risk Management model must address the enterprise’s objectives with control objectives for risk in what categories of business?

A
  • Planning, Operational, Financial reporting and Compliance
126
Q

Separation of Duties (SOD) is also called what?

A

Segregation of duties

127
Q

What is a key component to maintaining a strong internal control environment? Why?

A
  • Separation of Duties

- It reduces risk of errors and fraudulent transactions

128
Q

What is the result of of duties for a process or transaction are segregated? Why?

A

It forces the involvement of more than one person to accomplish a task and it becomes more difficult for fraudulent activity occur
- It would require collusion among several employees

129
Q

Automated SOD tools contain what three elements?

A
  • Access control
  • Process control
  • Continuous monitoring
130
Q

In SOD, explain Access Controls?

A
  • Restrict access to the business system and data to ensure only authorized individuals have access and the user is granted the minimal level of access required to perform their duties
131
Q

In SOD, explain Process Controls? What are some of the techniques employed?

A

Restrict the activities performed by authorized users.

  • Dual control - requiring two people to take action simulataneously to perform a task
  • Mutual exclusivity - one person has executed a task, they are prohibited from executing subsequent tasks
132
Q

in SOD, explain Continuous monitoring?

A

-Employs automation to detect system transactions, setup or data changes that contravene corporate policy

133
Q

What are two specific contribution areas for IT in managing business risk?

A
  • Locked-down operating

- Decision support, risk analytics and reporting

134
Q

What is Locked-down operating? Give an example?

A
  • IT can be used to build in business process controls through automation. Automation forces routine aspects of business to be locked down to a predictible and repeatable pattern
  • Example: Using templates
135
Q

What is the goal of risk management for information systems?

A

To achieve compatible and efficient IT monitoring and reporting processes for capturing; analyzing; and ultimately reporting risk factors of all types across the enterprise

136
Q

What does Risk Awareness acknowledge?

A
  • Risk is well understood and known
  • IT risk issues are identifable
  • The enterprise recognizes and uses the means to risk
137
Q

If risk is to be managed and mitigated what must first be done?

A

-Discussed and effectively communicated at an appropriate level tothe various stakeholders and personnel

138
Q

What are the benefits of open communication on risk?

A
  • Assitance in executive management’s understanding of the actual exposure to IT risk
  • Awareness among all internal stakeholders of the importance of integrating risk management into their daily duties
  • Transparency to external stakeholders regarding the actual level of risk and risk management processes in use
139
Q

What are the consequences of poor risk communication?

A
  • A false sense of confidence at all levels of the enterprise and higher risk of a breach or incident that could have been prevented
  • Lack of direction or strategic planning to mandate risk management efforts
  • Unbalanced communication to the external world on risk, especially in cases of high, but managed, risk, which may lead to an incorrect perception on actual risk by third parties
  • Perception that the enterprise is trying to cover up known risk from stakeholders
140
Q

What is an unacceptable risk management strategy?

A

-Risk ignorance

141
Q

What are the risk components to be communicated?

A
  • Expectations from risk management
  • Current risk management capability
  • Status
142
Q

Why is Expectations from Risk Management an essential communication component?

A
  • Communicates the risk strategy, policies, procedures, awareness training, continuopus reinforcement of principles
  • Drives all subsequent efforts on risk management
  • Sets the ovall expectations about the risk management program
143
Q

What information comes from Current Risk Management Capability communication?

A
  • Allows for monitoring of the state of the “risk management engine” in the enterprise
  • Is a key indicator for good risk management
  • Has predictive vaule for how well the enterprise is managing risk and reducing exposure
144
Q

Status communication consists of?

A
  • Risk profile of the enterprise; the overall portfolio of (identified) risk to which the enterprise is exposed
  • Key risk indicators (KRI) to support management reporting on risk
  • Event/loss data
  • Root cause of loss events
  • Options to mitigate risk (incl cost and benefits)
145
Q

What are the required elements of effective communication?

A
  • Clear
  • Concise
  • Useful
  • Timely
  • Correct target audience
  • Available on a need-to-know basis

CRISC (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions