easyMultiple ChoiceObjective-mapped
CRISC Practice Question: A technology company has implemented a risk and…
A technology company has implemented a risk and control monitoring program for its software development lifecycle. The program includes key risk indicators (KRIs) such as number of critical bugs found in production, code review coverage, and time to patch vulnerabilities. After six months, the risk committee noticed that the KRI for code review coverage is consistently green (within threshold), but the number of critical bugs in production remains high. The risk manager suspects a disconnect between the KRI and actual risk. What should the risk manager do FIRST?
⚠ Common exam trap
The trap here is that candidates often jump to a corrective action (like adding controls or adjusting thresholds) without first questioning the validity of the KRI itself, which is the foundational step in risk and control monitoring.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Review the KRI definition and data source to ensure it reflects effective code review.
The risk manager must first validate that the KRI for code review coverage is actually measuring the effectiveness of code reviews, not just their completion. If the KRI is green but critical bugs persist, the data source or definition may be flawed—for example, measuring the percentage of code reviewed rather than the quality of reviews. Without this validation, any subsequent action (like adding controls or adjusting thresholds) would be based on unreliable information.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement additional testing controls to catch bugs before production.
Why it's wrong here
Additional controls may help but do not address the KRI issue.
- ✗
Reduce the code review coverage target to lower the risk appetite.
Why it's wrong here
Reducing coverage would likely increase bugs.
- ✓
Review the KRI definition and data source to ensure it reflects effective code review.
Why this is correct
The KRI may be measuring review quantity, not quality.
- ✗
Adjust the code review coverage threshold to a higher percentage.
Why it's wrong here
Raising the threshold does not fix the measurement issue.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 983 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.