mediumMultiple Choice
CRISC Practice Question: A risk practitioner is designing a monitoring…
A risk practitioner is designing a monitoring dashboard for senior management. Which key performance indicator (KPI) would be MOST useful for tracking control effectiveness over time?
⚠ Common exam trap
Many exam-takers confuse outcome-based metrics (like incident counts) with control effectiveness metrics, failing to recognize that a KPI for control effectiveness must directly measure control performance, not the consequences of control failure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Percentage of controls passing automated tests.
The percentage of controls passing automated tests directly measures the effectiveness of controls over time. A trend of increasing or stable high percentages indicates that controls are functioning as intended, while a decline signals degradation. This KPI is specifically designed for control monitoring, unlike metrics that measure activity or outcomes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Number of security incidents reported.
Why it's wrong here
Incident counts measure threat occurrence and detection outcomes, not whether controls operate as designed; a falling count can reflect fewer attacks rather than stronger controls. Incident reporting suits operational security monitoring, whereas control effectiveness needs metrics tied to control operation, such as percentage of controls tested and passing.
- ✗
Number of transactions processed per hour.
Why it's wrong here
Operational metric, not control effectiveness.
- ✗
Value at Risk (VaR) for operational risk.
Why it's wrong here
VaR quantifies potential financial loss from operational risk exposures, not whether controls operate as intended; it aggregates monetary impact rather than measuring control performance. It is tempting because VaR suits capital allocation and risk-appetite reporting, and would be correct when the dashboard must communicate maximum expected loss over a defined horizon.
- ✓
Percentage of controls passing automated tests.
Why this is correct
Automated control tests produce a repeatable, time-series metric showing what proportion of controls actually operate as designed. Tracking this percentage over time reveals control drift or degradation, giving senior management an objective measure of control effectiveness rather than activity or incident volumes.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 1,062-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.