mediumMultiple ChoiceObjective-mapped
CRISC Practice Question: A retail company uses a manual control to verify…
A retail company uses a manual control to verify that all credit card transactions are processed by authorized payment terminals. The control requires a store manager to compare a daily transaction log against a list of approved terminal IDs. The company processes an average of 10,000 transactions per day across 200 stores. During a recent internal audit, it was found that 15% of stores had not completed the reconciliation for the past month. The audit also revealed that several unauthorized terminals had been used to process transactions, resulting in a data breach of customer payment information. The company's risk appetite for payment card data security is very low. The current monitoring approach includes a quarterly review of control performance by the internal audit team. The risk manager needs to recommend improvements to the monitoring of this control. Which of the following is the BEST recommendation?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Automate the reconciliation by integrating the transaction log with the approved terminal list.
Automating the reconciliation process ensures it is performed consistently and promptly, eliminating the manual gaps. Option A is wrong because increasing audit frequency does not prevent the control from being skipped. Option B is wrong because disciplinary actions may motivate compliance but do not address the process inefficiency. Option D is wrong because additional training may help but does not guarantee consistent performance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Increase internal audit reviews of the control to monthly.
Why it's wrong here
More audits detect failures but do not prevent them.
- ✗
Implement disciplinary actions for store managers who skip reconciliations.
Why it's wrong here
Punitive measures are reactive and may not be sustainable.
- ✓
Automate the reconciliation by integrating the transaction log with the approved terminal list.
Why this is correct
Automation enforces the control, reduces manual effort, and provides real-time monitoring.
- ✗
Provide refresher training to all store managers on the procedure.
Why it's wrong here
Training alone does not ensure compliance.
Go deeper
Related to this question
About these practice questions
One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.