easyMultiple SelectObjective-mapped
CRISC Practice Question: Designing its risk and control monitoring program
A company is designing its risk and control monitoring program. Which TWO of the following are key attributes of effective monitoring?
⚠ Common exam trap
Candidates often confuse independence as a mandatory attribute for all monitoring, whereas the CRISC framework recognizes that control owner self-assessment is a valid monitoring technique, and independence is only required for specific assurance activities like internal audits.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Monitoring results should be communicated to stakeholders.
Effective monitoring requires that results are communicated to stakeholders to ensure informed decision-making and timely remediation. Without communication, monitoring loses its value as stakeholders cannot act on identified risks or control deficiencies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
All controls should be monitored at the same frequency.
Why it's wrong here
Frequency should vary based on risk and criticality.
- ✗
Monitoring should only be performed by external auditors.
Why it's wrong here
Internal resources can effectively monitor controls.
- ✓
Monitoring results should be communicated to stakeholders.
Why this is correct
Communication enables informed decision-making.
- ✗
Monitoring should be independent of the control owner.
Why it's wrong here
Independence is beneficial but not a mandatory attribute; self-assessment is acceptable.
- ✓
Monitoring frequency should be determined by control criticality.
Why this is correct
Critical controls require more frequent monitoring.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 983-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.