Risk Monitoring, Reporting, and KRIs Flashcards

Which approach BEST ensures that risk reporting supports informed decision-making by senior management?

Answer: Tailoring report content and format to the audience's decision-making needs

Effective risk reporting presents the right information in the right format for each audience so that recipients can make well-informed decisions.

A CRISC practitioner identifies that a KRI has been consistently at its threshold for three months. The BEST response is to:

Answer: Treat the elevated KRI as a signal to reassess the underlying risk and controls

A KRI persistently at threshold indicates that the risk environment is stressed, requiring reassessment of whether current controls are sufficient.

Which risk monitoring technique involves comparing actual control performance against defined benchmarks?

Answer: Control effectiveness testing

Control effectiveness testing measures whether controls are performing as intended by comparing actual performance to expected benchmarks.

When integrating risk monitoring into IT operations, which approach BEST supports continuous assurance?

Answer: Embedding automated control monitoring into operational workflows

Continuous assurance requires automated monitoring embedded in operations so that control status is constantly evaluated rather than periodically checked.

Which scenario BEST illustrates effective use of a KRI in practice?

Answer: An alert fires when failed login attempts exceed 500 per hour, prompting investigation before a breach occurs

A KRI threshold triggering proactive investigation before a breach is the ideal use of KRIs — early warning enabling intervention before loss.

Which standard provides CRISC practitioners with guidance on information security controls monitoring and measurement?

Answer: ISO/IEC 27004

ISO/IEC 27004 specifically addresses the measurement and evaluation of information security management system (ISMS) controls and processes.