mediumMultiple ChoiceObjective-mapped
CRISC Practice Question: An incident occurs due to a control that was…
An incident occurs due to a control that was thought to be automated but was actually manual. The risk register did not reflect this. What is the MOST likely root cause?
⚠ Common exam trap
The CRISC exam often tests the distinction between a control being 'poorly designed' versus 'not operating as intended' — the trap here is that candidates see a control failure and immediately assume a design flaw, when the real issue is a lack of verification that the control's implementation matches its documented design.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Insufficient control monitoring and verification
The core issue is that the control was believed to be automated but was actually manual, and this discrepancy was not captured in the risk register. This indicates a failure in the ongoing process of verifying that controls are operating as designed, which is the essence of control monitoring and verification. Without periodic testing or validation, the organization cannot confirm the control's effectiveness or its true nature, leading to an inaccurate risk posture.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Insufficient control monitoring and verification
Why this is correct
Control operation was not verified against documentation.
- ✗
Inadequate risk assessment methodology
Why it's wrong here
Methodology may be fine; issue is monitoring.
- ✗
Poorly designed controls
Why it's wrong here
Control design was appropriate; operation not monitored.
- ✗
Lack of management support for risk management
Why it's wrong here
Not indicated.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 983 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.