mediumMultiple SelectObjective-mapped
Two Key Elements of an Effective Control Monitoring Framework: Roles and KRI Review
A company is evaluating its control monitoring program. Which TWO of the following are key elements of an effective control monitoring framework? (Choose two.)
Quick Answer
The answer is clearly defined roles and responsibilities and periodic review of KRI thresholds. These two elements form the backbone of an effective control monitoring framework because roles ensure accountability for monitoring activities, while KRI thresholds must be regularly reviewed to keep the framework responsive to changing risk levels. On the CRISC exam, this question tests your understanding that a monitoring framework is not about automation or integration with performance management, but about who does what and how risk indicators stay relevant. A common trap is selecting “automated alerts for all failures,” but the exam emphasizes that manual escalation is often appropriate and cost-effective. Remember the mnemonic “Roles and Reviews” — if a framework lacks clear ownership or stale KRIs, it will fail to detect control degradation in time.
⚠ Common exam trap
Many candidates confuse operational efficiency elements (like performance management or full automation) with the foundational governance and risk-alignment components that ISACA emphasizes for effective control monitoring.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Periodic review of KRI thresholds.
Periodic review of KRI thresholds is a key element because KRIs must remain aligned with the evolving risk landscape; thresholds that are not reviewed can become obsolete, leading to false positives or missed risk indicators. Clearly defined roles and responsibilities ensure accountability for control execution, monitoring, and escalation, which is foundational to any effective control monitoring framework.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Integration with performance management.
Why it's wrong here
Not a key element; risk monitoring is distinct.
- ✓
Periodic review of KRI thresholds.
Why this is correct
Thresholds must be reviewed to remain aligned with risk appetite.
- ✗
Use of statistical sampling for all tests.
Why it's wrong here
Sampling is one technique, not a requirement for all controls.
- ✗
Automated alerts for all control failures.
Why it's wrong here
Automated alerts may be excessive and not all failures warrant immediate alerts.
- ✓
Clearly defined roles and responsibilities.
Why this is correct
Essential for accountability and ownership.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 983 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CRISC
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is designing its risk and control monitoring program. Which TWO of the following are key attributes of effective monitoring?
easy- A.All controls should be monitored at the same frequency.
- B.Monitoring should only be performed by external auditors.
- ✓ C.Monitoring results should be communicated to stakeholders.
- D.Monitoring should be independent of the control owner.
- ✓ E.Monitoring frequency should be determined by control criticality.
Why C: Effective monitoring requires that results are communicated to stakeholders to ensure informed decision-making and timely remediation. Without communication, monitoring loses its value as stakeholders cannot act on identified risks or control deficiencies.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.