easyMultiple SelectObjective-mapped
CRISC Practice Question: A risk manager is designing a monitoring and…
A risk manager is designing a monitoring and reporting framework. Which THREE of the following are essential components of an effective risk and control monitoring program?
⚠ Common exam trap
ISACA often tests the distinction between KPIs and KRIs, where candidates mistakenly select KPIs because they confuse operational performance metrics with risk indicators, but KPIs do not directly measure risk exposure or control effectiveness.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Control self-assessments (CSAs)
Control self-assessments (CSAs) are essential because they empower process owners to evaluate the design and operating effectiveness of internal controls, providing firsthand evidence for the monitoring program. This bottom-up approach complements top-down testing by identifying control gaps and remediation needs directly from those who execute the controls, which is critical for a comprehensive risk and control monitoring framework.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Control self-assessments (CSAs)
Why this is correct
CSAs involve business owners evaluating control effectiveness, which is essential for monitoring.
- ✗
Key performance indicators (KPIs)
Why it's wrong here
KPIs measure business performance, not risk levels; they are not a primary component of risk monitoring.
- ✓
Risk reporting dashboards
Why this is correct
Dashboards provide a consolidated view of risk information for decision-making and are integral to monitoring and reporting.
- ✓
Key risk indicators (KRIs)
Why this is correct
KRIs are designed to monitor changes in risk levels and are a core component of a risk monitoring program.
- ✗
Risk response plans
Why it's wrong here
Risk response plans document actions to address risks once identified, but are not part of ongoing monitoring.
Go deeper
Related to this question
About these practice questions
One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.