Skip to main content
ITPrepCerts
Login
Exams Free Samples About Contact
Login Create an account

CRISC Certified in Risk and Information Systems Control

  • ISACA
  • 7 free sample questions

About this exam

CRISC is the ISACA exam Certified in Risk and Information Systems Control. Paid practice material for this exam is not available yet, but you can try its free sample questions.

Exam code
CRISC
Vendor
ISACA
Practice questions
Not available yet
Free sample questions
7
Question bank last updated
Not available yet

Try 2 sample questions

Taken from the free sample set for CRISC.

Question 1

Which of the following is the MOST important reason to link an effective key control indicator (KCI) to relevant key risk indicators(KRIs)?

  1. Option A:
    To monitor changes in the risk environment
  2. Option B:
    To provide input to management for the adjustment of risk appetite
  3. Option C:
    To monitor the accuracy of threshold levels in metrics
  4. Option D:
    To obtain business buy-in for investment in risk mitigation measures
Show answer and explanation

Correct answer: A

Key control indicators (KCIs) are metrics that measure how well a specific control is performing in reducing the causes, consequences, or likelihood of a risk1. Key risk indicators (KRIs) are metrics that measure changes in the risk exposure or the potential impact of a risk2. By linkingan effective KCI to relevant KRIs, the organization can monitor changes in the risk environment and assess how the control is influencing the risk level3. This can help the organization to: Identify emerging or escalating risks and take timely and appropriate actions Evaluate the effectiveness and efficiency of the control and make improvements if needed Align the control with the risk appetite and tolerance of the organization Communicate the risk and control status to stakeholders and regulators
Reference = Risk and Information Systems Control Study Manual, Chapter 6: Risk Response and Mitigation4 

Question 2

While reviewing an organization's monthly change management metrics, a risk practitioner notes that the number of emergency changes has increased substantially Which of the following would be the BEST approach for the risk practitioner to take? 

  1. Option A:
    Temporarily suspend emergency changes. 
  2. Option B:
    Document the control deficiency in the risk register.
  3. Option C:
    Conduct a root cause analysis.
  4. Option D:
    Continue monitoring change management metrics. 
Show answer and explanation

Correct answer: C

According to the CRISC Review Manual, a root cause analysis is a technique that identifies the underlying causes of an event or a problem. It helps to determine the most effective actions to prevent or mitigate the recurrence of the event or problem. A root cause analysis is the best approach for the risk practitioner to take in this scenario, because it will help to understand why the number of emergency changes has increased substantially and what can be done to address the issue. The other options are not the best approaches, because they do not address the underlying causes of the problem. Temporarily suspending emergency changes may disrupt the business operations and create more risks. Documenting the control deficiency in the risk register is a passive action that does not resolve the problem. Continuing monitoring change management metrics is an ongoing activity that does not provide any insight into the problem.
Reference = CRISC Review Manual, 7th Edition, Chapter 3, Section 3.2.4, page 130.
See all 7 free sample questions