CRISC Risk and Control Monitoring and Reporting Practice Test 11 — 15 Questions

Question 1

A company uses a risk control self-assessment (RCSA) process that is conducted annually. During a quarterly review, management discovers that several high-risk controls are no longer effective due to changes in the business environment. Which of the following is the BEST way to enhance the monitoring of these controls?

Accepted Answer

Deploy automated control monitoring tools for continuous assessment.. Option C is correct because implementing continuous control monitoring provides real-time insights into control effectiveness. Option A is wrong because annual RCSA is too infrequent for rapidly changing risks. Option B is wrong while compensating controls may help, they do not directly improve monitoring of the existing controls. Option D is wrong because increasing the frequency of RCSA to quarterly still relies on periodic self-assessments, which may not be timely.

Answer

Increase the frequency of the RCSA to quarterly.

Answer

Assign a risk owner to perform manual checks monthly.

Answer

Implement compensating controls to reduce the risk.

Question 2

A risk analyst is reviewing monthly control test results. One control failed testing twice in a row. What is the FIRST step the analyst should take?

Accepted Answer

Perform a root cause analysis of the control failure.. Option A is correct because understanding the root cause helps determine whether the failure is due to a control design issue or an operational lapse. Option B is wrong because escalating without analysis may cause unnecessary alarm. Option C is wrong because reporting to management without context is incomplete. Option D is wrong because updating the risk register should follow root cause analysis.

Answer

Report the failure in the next risk report to management.

Answer

Update the risk register with a higher inherent risk rating.

Answer

Escalate the failure to the risk committee immediately.

Question 3

An organization is designing a risk dashboard for senior management. Which of the following is the MOST important characteristic of the key risk indicators (KRIs) displayed?

Accepted Answer

They are directly linked to the risk appetite thresholds.. Option C is correct because KRIs should be aligned to the risk appetite to effectively communicate risk levels to management. Option A is wrong while timeliness is important, it is not the most important characteristic for management decision-making. Option B is wrong accuracy is crucial, but KRIs must first be relevant to risk appetite. Option D is wrong cost-effectiveness is a consideration but not the primary characteristic for a management dashboard.

Answer

They are updated in real-time.

Answer

They are based on accurate historical data.

Answer

They are cost-effective to collect and maintain.

Question 4

A financial institution has a control that manually reviews all wire transfers over $10,000. During an audit, it was found that the review is completed within 24 hours for 95% of transactions, but the target is 99%. The process owner wants to improve the control's effectiveness. Which of the following would be the MOST effective remediation?

Accepted Answer

Automate the review process using an application control.. Option D is correct because automating the review process ensures consistent and timely completion without relying on manual effort. Option A is wrong simply setting a stricter target does not address the underlying process issue. Option B is wrong increasing staff may help but is less efficient than automation. Option C is wrong adding another approval step would further delay the process.

Answer

Implement a second level of approval for all wire transfers.

Answer

Increase the number of staff performing the reviews.

Answer

Adjust the target to 95% to reflect current performance.

Question 5

During a control monitoring review, a risk analyst discovers that the control owner has not been performing the required monthly reconciliations. What should the analyst do FIRST?

Accepted Answer

Contact the control owner to understand the reason for non-performance.. Option B is correct because the analyst should first confirm with the control owner to understand why the control was not performed, as it may be a temporary issue or training gap. Option A is wrong escalating immediately without understanding the context is premature. Option C is wrong updating the risk register should follow the investigation. Option D is wrong assuming the control is ineffective without investigation is not appropriate.

Answer

Escalate to the risk committee for immediate action.

Answer

Update the risk register to reflect control deficiency.

Answer

Recommend removal of the control as it is not being followed.

Question 6

A company is implementing a new continuous monitoring tool for its network security controls. Which of the following is the MOST important step to ensure the tool provides meaningful risk information?

Accepted Answer

Align the tool's monitoring parameters with key risk indicators and critical controls.. Option C is correct because the tool must be configured to monitor the key controls that address high-risk areas to be effective. Option A is wrong real-time alerts are useful but not the most important if they monitor irrelevant controls. Option B is wrong integration with SIEM is operational, not a prerequisite for meaningful risk info. Option D is wrong training is important but secondary to proper configuration.

Answer

Configure the tool to generate real-time alerts for all events.

Answer

Provide training to all users on how to interpret the tool's output.

Answer

Ensure the tool is integrated with the existing SIEM system.

Question 7

Which TWO of the following are primary purposes of risk and control monitoring? (Choose two.)

Accepted Answer

To verify that controls are operating as intended.. Options A and D are correct. Monitoring ensures controls are operating effectively and provides evidence for assurance. Option B is wrong because eliminating all risk is not possible; monitoring helps manage but not eliminate risk. Option C is wrong because implementing new controls is a response, not a purpose of monitoring. Option E is wrong because compliance is a result, but the primary purpose is to assess effectiveness.

Answer

To identify opportunities for implementing new controls.

Answer

To ensure compliance with all regulatory requirements.

Answer

To eliminate all residual risk.

Question 8

Which THREE of the following are key considerations when designing a risk reporting framework? (Choose three.)

Accepted Answer

Timeliness of the information provided.. Options A, B, and D are correct. Risk reporting should be timely to support decision-making, tailored to the audience, and consistent over time for trend analysis. Option C is wrong because including all detailed data can overwhelm management. Option E is wrong because reporting should generally align with the organization's risk appetite, not external benchmarks.

Answer

Including all operational data for completeness.

Answer

Aligning with industry best practices for risk reporting.

Question 9

Which TWO of the following are examples of key risk indicators (KRIs) in an IT environment? (Choose two.)

Accepted Answer

Number of critical security vulnerabilities unresolved for more than 30 days.. Options A and C are correct. System uptime percentage and number of unresolved critical vulnerabilities are direct measures of IT risk. Option B is wrong number of employees is a people metric, not a risk indicator. Option D is wrong budget variance is a financial metric, not a KRI specifically. Option E is wrong number of IT projects is a workload metric, not a risk indicator.

Answer

Number of IT projects in progress.

Answer

Number of employees in the IT department.

Answer

Annual IT budget variance.

Question 10

You are the risk manager for a multinational corporation that relies heavily on a cloud-based ERP system. The system is critical for financial reporting and supply chain management. Recently, the company experienced a significant increase in the number of failed user authentication attempts, which were traced to a misconfiguration in the identity management module. The misconfiguration was detected by the security operations center (SOC) through log analysis, but it took three days to identify and resolve. The root cause was a change made by a cloud administrator without following the change management process. The incident resulted in a temporary denial of service for external users. The company's risk appetite for system availability is low, with a tolerance for downtime of no more than one hour per month. The current monitoring controls include quarterly access reviews and SOC monitoring of logs with a 24-hour review cycle. The board has requested a report on the incident and recommendations to prevent recurrence. What is the MOST effective recommendation to improve monitoring and reduce the likelihood of similar incidents?

Accepted Answer

Implement automated real-time monitoring of critical configuration changes with alerts.. Option B is correct because implementing real-time monitoring of critical configuration changes would have detected the misconfiguration immediately, preventing the extended downtime. Option A is wrong because while increasing change management oversight is important, it does not directly improve monitoring of the configuration itself. Option C is wrong because user awareness training does not address the configuration change issue. Option D is wrong because quarterly access reviews are too infrequent to catch unauthorized changes in a timely manner.

Answer

Require all change requests to be approved by the change advisory board (CAB).

Answer

Increase the frequency of access reviews to monthly.

Answer

Provide additional training to cloud administrators on security policies.

Question 11

A retail company uses a manual control to verify that all credit card transactions are processed by authorized payment terminals. The control requires a store manager to compare a daily transaction log against a list of approved terminal IDs. The company processes an average of 10,000 transactions per day across 200 stores. During a recent internal audit, it was found that 15% of stores had not completed the reconciliation for the past month. The audit also revealed that several unauthorized terminals had been used to process transactions, resulting in a data breach of customer payment information. The company's risk appetite for payment card data security is very low. The current monitoring approach includes a quarterly review of control performance by the internal audit team. The risk manager needs to recommend improvements to the monitoring of this control. Which of the following is the BEST recommendation?

Accepted Answer

Automate the reconciliation by integrating the transaction log with the approved terminal list.. Option D is correct because automating the reconciliation process ensures it is performed consistently and promptly, eliminating the manual gaps. Option A is wrong increasing audit frequency does not prevent the control from being skipped. Option B is wrong disciplinary actions may motivate compliance but do not address the process inefficiency. Option C is wrong additional training may help but does not guarantee consistent performance.

Answer

Increase internal audit reviews of the control to monthly.

Answer

Implement disciplinary actions for store managers who skip reconciliations.

Answer

Provide refresher training to all store managers on the procedure.

Question 12

A technology company has implemented a risk and control monitoring program for its software development lifecycle. The program includes key risk indicators (KRIs) such as number of critical bugs found in production, code review coverage, and time to patch vulnerabilities. After six months, the risk committee noticed that the KRI for code review coverage is consistently green (within threshold), but the number of critical bugs in production remains high. The risk manager suspects a disconnect between the KRI and actual risk. What should the risk manager do FIRST?

Accepted Answer

Review the KRI definition and data source to ensure it reflects effective code review.. Option C is correct because the KRI may not be accurately measuring risk; reviewing the KRI definition and data source will identify if it is measuring the right thing. Option A is wrong immediately modifying the threshold does not address the underlying measurement issue. Option B is wrong reducing coverage would likely increase risk. Option D is wrong additional testing is a separate issue; the KRI itself needs investigation.

Answer

Implement additional testing controls to catch bugs before production.

Answer

Reduce the code review coverage target to lower the risk appetite.

Answer

Adjust the code review coverage threshold to a higher percentage.

Question 13

A healthcare organization is subject to strict regulatory requirements regarding patient data privacy. The organization has a control that requires all access to patient records to be logged and reviewed weekly by the compliance team. The review is currently performed manually by sampling 10% of the logs. The compliance team reports that the review takes 20 hours per week and they are often unable to complete it on time. As a result, some suspicious access patterns are detected weeks after they occur. The risk manager needs to propose an improvement to the monitoring process. The organization's risk appetite for undetected unauthorized access is very low. Which of the following is the MOST effective recommendation?

Accepted Answer

Deploy user behavior analytics (UBA) tools for automated anomaly detection.. Option B is correct because implementing user behavior analytics (UBA) automates the detection of anomalous access patterns, reducing manual effort and improving detection speed. Option A is wrong increasing sample size does not address the timeliness issue. Option C is wrong hiring more staff is costly and may not scale. Option D is wrong reducing frequency would delay detection further, increasing risk.

Answer

Reduce the review frequency to bi-weekly to free up time.

Answer

Hire additional staff to perform the manual reviews.

Answer

Increase the sample size to 50% of logs for better coverage.

Question 14

A financial institution is implementing a new continuous monitoring solution for its transaction processing systems. The solution generates alerts for suspicious activities. Which TWO of the following are essential considerations when defining the alert thresholds?

Accepted Answer

Historical transaction patterns and baseline deviations. Alert thresholds should align with historical transaction patterns and risk appetite. Cost and vendor reputation are relevant but not essential for threshold definition; reducing thresholds increases false positives.

Answer

Cost of the monitoring solution

Answer

Vendor reputation for support

Answer

Number of employees in the monitoring team

Question 15

An organization recently experienced a significant security incident that was not detected by existing monitoring controls. The risk team is reviewing the effectiveness of the control monitoring framework. Which THREE of the following are key factors that should be evaluated to improve detection capabilities?

Accepted Answer

The correlation rules between different monitoring tools. Timely data collection, correlation rules, and coverage across high-risk assets are critical. Automation level and incident response plans, while important, are not primary detection factors.

Answer

The existence of an incident response plan

Answer

The level of automation in incident response