CRISC Risk and Control Monitoring and Reporting — 15 Questions

Question 1

A security analyst notices that the number of failed login attempts has significantly increased over the past week. The SIEM alerts are not being triggered because the threshold was set too high. What is the MOST effective immediate action to improve monitoring?

Accepted Answer

Lower the threshold for failed login alerts in the SIEM.. B is correct because the immediate issue is that the SIEM alert threshold is set too high, causing failed login attempts to go undetected. Lowering the threshold directly addresses the monitoring gap by ensuring that the SIEM generates alerts for anomalous failed login activity, enabling timely incident response without requiring a system overhaul.

Answer

Implement a new authentication system with biometrics.

Answer

Enable all SIEM rules to capture every event.

Answer

Review logs manually each day to identify anomalies.

Question 2

A risk manager is reviewing the control monitoring reports and finds that a key control's effectiveness rating has dropped from 'effective' to 'partially effective' due to increased errors in manual data entry. Which of the following is the BEST course of action?

Accepted Answer

Conduct a root cause analysis to identify why errors increased.. A root cause analysis (RCA) is the best course of action because it systematically identifies the underlying reasons for the increased manual data entry errors, such as inadequate training, unclear procedures, or system interface issues. Without understanding the root cause, any corrective action (like automation or additional staff) may address symptoms rather than the actual problem, leading to wasted resources or recurring control failures. This aligns with the CRISC principle that control effectiveness must be restored by addressing the fundamental cause of degradation, not just the symptoms.

Answer

Immediately implement an automated data entry solution.

Answer

Increase the frequency of monitoring to detect errors sooner.

Answer

Assign additional staff to double-check data entries.

Question 3

A company has implemented a new control to detect unauthorized access attempts. What is the PRIMARY purpose of monitoring this control?

Accepted Answer

To confirm the control is working effectively.. The primary purpose of monitoring a detective control, such as one that detects unauthorized access attempts, is to confirm that the control is operating effectively as designed. Monitoring provides ongoing assurance that the control is correctly identifying and logging unauthorized access events, which is essential for maintaining the security posture and for timely incident response.

Answer

To provide evidence for regulatory audits.

Answer

To reduce the number of unauthorized access attempts.

Answer

To calculate the residual risk level.

Question 4

A risk practitioner is designing a monitoring dashboard for senior management. Which key performance indicator (KPI) would be MOST useful for tracking control effectiveness over time?

Accepted Answer

Percentage of controls passing automated tests.. Option D is correct because the percentage of controls passing automated tests directly measures the effectiveness of controls over time. A trend of increasing or stable high percentages indicates that controls are functioning as intended, while a decline signals degradation. This KPI is specifically designed for control monitoring, unlike metrics that measure activity or outcomes.

Answer

Number of security incidents reported.

Answer

Number of transactions processed per hour.

Answer

Value at Risk (VaR) for operational risk.

Question 5

A company has multiple business units each using different risk assessment methodologies. The risk committee wants consistent monitoring reports. What is the BEST approach to achieve consistency?

Accepted Answer

Develop and mandate a standardized risk assessment methodology.. Option A is correct because mandating a standardized risk assessment methodology ensures that all business units apply the same criteria, scales, and processes for identifying, analyzing, and evaluating risks. This eliminates methodological inconsistencies at the source, enabling the risk committee to produce truly comparable and reliable monitoring reports across the enterprise.

Answer

Aggregate risks at the enterprise level using a common taxonomy.

Answer

Require each business unit to adopt the same risk scoring scale.

Answer

Create a centralized reporting template with predefined fields.

Question 6

During a control monitoring review, it is discovered that a detective control has a high false positive rate. What is the MOST significant impact of this issue?

Accepted Answer

Increased risk of missing actual security incidents.. Option D is correct because high false positives can cause alert fatigue, leading to missed real incidents. Option A is a secondary effect. Option B is not directly caused by false positives. Option C is a possible result but not the most significant.

Answer

Loss of confidence in the control by management.

Answer

Reduced system performance due to alert processing.

Answer

Increased cost of investigating alerts.

Question 7

A risk officer is evaluating the effectiveness of a control that prevents unauthorized changes to configuration files. The control has not detected any unauthorized changes in the past year. What does this indicate?

Accepted Answer

Further testing is needed to determine control effectiveness.. The absence of detected unauthorized changes does not automatically confirm control effectiveness; it could also indicate that the control is not properly configured to detect changes (e.g., missing file integrity monitoring rules, incorrect baseline, or disabled logging). Further testing—such as manually introducing a test change or reviewing audit logs—is required to verify that the control can actually detect violations. This aligns with CRISC best practices for validating control effectiveness through testing rather than relying solely on absence of alerts.

Answer

The control is unnecessary because no changes occurred.

Answer

The control is not configured correctly to detect changes.

Answer

The control is operating effectively and no violations occurred.

Question 8

A large organization is implementing a continuous monitoring program for its critical systems. Which of the following is the MOST important factor for the program's success?

Accepted Answer

Integration with automated incident response workflows.. Integration with automated incident response workflows is the most important factor because continuous monitoring is only effective if detected anomalies or threats can be acted upon in near real-time. Without automated response, alerts may be ignored or delayed, rendering the monitoring program ineffective. This aligns with the CRISC focus on reducing risk through timely remediation, not just detection.

Answer

Use of advanced analytics and machine learning.

Answer

Support from senior management.

Answer

Clear definition of monitoring scope and objectives.

Question 9

A control owner reports that a preventive control is operating as designed, but the risk owner is concerned that residual risk remains high. What should the risk practitioner do NEXT?

Accepted Answer

Perform a control effectiveness test to validate the control.. The risk practitioner must first validate the control's effectiveness before taking any further action. Even though the control owner reports the preventive control is operating as designed, the risk owner's concern about high residual risk suggests the control may not be adequately mitigating the risk. Performing a control effectiveness test (D) provides objective evidence to determine whether the control is actually reducing risk to an acceptable level, which is the necessary next step before updating the risk register, recommending compensating controls, or escalating.

Answer

Update the risk register to reflect the high residual risk.

Answer

Recommend additional compensating controls.

Answer

Escalate the issue to the risk committee.

Question 10

A company's risk monitoring report shows that a key risk indicator (KRI) has exceeded the threshold for three consecutive months. What is the MOST appropriate action?

Accepted Answer

Conduct a root cause analysis and implement corrective actions.. A KRI that has exceeded its threshold for three consecutive months indicates a persistent risk condition, not a transient anomaly. The most appropriate action is to conduct a root cause analysis to identify the underlying issue and implement corrective actions to bring the risk back within acceptable levels. This aligns with the CRISC domain of Risk and Control Monitoring and Reporting, which emphasizes proactive remediation over passive observation or threshold manipulation.

Answer

Wait for the KRI to return to normal on its own.

Answer

Raise the threshold to avoid future breaches.

Answer

Implement temporary manual controls.

Question 11

A risk practitioner is reviewing the results of a control self-assessment (CSA) and finds that the control owner rated a control as 'effective' but an independent audit found control weaknesses. What is the BEST explanation for this discrepancy?

Accepted Answer

The control owner may have a biased perception of control effectiveness.. The control owner's self-assessment is inherently subjective and may be influenced by personal bias, lack of objectivity, or a desire to report favorable results. An independent audit provides an objective, evidence-based evaluation, so a discrepancy where the owner rates a control as 'effective' while the audit finds weaknesses strongly suggests the owner's perception is skewed. This is the most direct and common explanation for such a conflict in control self-assessment (CSA) results.

Answer

The CSA was conducted too long ago.

Answer

The control owner did not understand the control objectives.

Answer

The audit used a different definition of 'effective'.

Question 12

Which TWO of the following are primary objectives of control monitoring?

Accepted Answer

To provide assurance to stakeholders that controls are functioning.. Control monitoring's primary objectives are to provide assurance to stakeholders that controls are functioning as intended and to verify that controls are operating effectively on an ongoing basis. This aligns with the CRISC framework's emphasis on continuous assurance over control performance, not just periodic assessment.

Answer

To calculate the financial impact of control failures.

Answer

To determine the design adequacy of controls.

Answer

To identify new risks that were not previously assessed.

Question 13

Which THREE of the following are key components of an effective risk reporting framework?

Accepted Answer

Consistent risk metrics across the organization.. Consistent risk metrics across the organization (Option B) are a key component of an effective risk reporting framework because they ensure that risk data is comparable and aggregated meaningfully across different business units and systems. Without standardized metrics, reports would be inconsistent, making it impossible to assess overall risk posture or identify trends reliably.

Answer

Automated collection of risk data from all sources.

Answer

Statistical models for predicting future risks.

Question 14

Which TWO of the following are examples of detective controls?

Accepted Answer

Review of access logs for unauthorized access.. A is correct because reviewing access logs for unauthorized access is a detective control. It involves examining historical records of system access events to identify security incidents or policy violations after they have occurred. This is a classic example of monitoring and analysis, not prevention or correction.

Answer

Backup and recovery procedures.

Answer

Firewall rules blocking unauthorized traffic.

Answer

Separation of duties in financial systems.

Question 15

Which THREE of the following are characteristics of leading key risk indicators (KRIs)?

Accepted Answer

They are predictive in nature.. Leading key risk indicators (KRIs) are predictive in nature because they track forward-looking metrics that signal potential future risk events before they occur. Unlike lagging indicators that measure past outcomes, leading KRIs use trend analysis and threshold monitoring to forecast changes in risk exposure, enabling organizations to anticipate and address issues proactively.

Answer

They are based on historical data.

Answer

They measure past events and losses.