CRISC Risk Response and Reporting Practice Question
A company is implementing a new access control system. During the project, the IT team updates the system configuration without notifying the risk team. This leads to a temporary misconfiguration that exposes sensitive data. Which process should have been followed to prevent this issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Change management process
Change management ensures that modifications to systems are authorized, reviewed, and communicated to relevant stakeholders to avoid unintended consequences.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Control design approval
Why it's wrong here
Design approval happens before implementation, not during changes.
- ✗
Continuous monitoring
Why it's wrong here
Continuous monitoring would detect the issue but not prevent it.
- ✓
Change management process
Why this is correct
Change management would have required notification and review before the update.
- ✗
Vendor risk assessment
Why it's wrong here
The issue is internal, not vendor-related.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 983 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.