Discuss Isaca CISA Exam Topic 9 Question 18

Which of the following is necessary for effective risk management in IT governance?

ARisk management strategy is approved by the audit committee

BRisk evaluation is embedded in management processes.

CLocal managers are solely responsible for risk evaluation

DIT risk management is separate from corporate risk management

Suggested Answer: B

Get Premium CISA Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

13 comments · newest first

Paris 11 months ago

I’m not convinced that embedding risk evaluation is enough.

Trina 12 months ago

D is a bad idea, IT risks should be part of the bigger picture.

Fatima 12 months ago

Wait, are local managers really supposed to handle all the risk evaluation? Seems risky!

Ciara 12 months ago

Totally agree, B is essential too!

Odette 1 year ago

A solid risk management strategy needs approval from the audit committee.

Oneida 1 year ago

I practiced a question similar to this, and I think integrating IT risk with corporate risk is crucial, so D seems wrong.

Jesusa 1 year ago

I feel like local managers being solely responsible for risk evaluation, like in option C, isn't a good idea. It seems too risky to me.

Berry 1 year ago

I'm not entirely sure, but I remember something about the audit committee needing to approve strategies. Could that be option A?

Suzi 1 year ago

I think option B makes the most sense since risk evaluation should be part of the overall management processes, right?

Eleonora 1 year ago

I'm a bit confused by this question. I know replication is important, but I'm not sure which user is specifically enabled for it. I'll have to make an educated guess on this one.

Kenneth 1 year ago

Hmm, this looks like a tricky one. We need something that feels like a desktop app but also loads fast and is SEO-friendly.

Jennifer 1 year ago

Hmm, I'm a bit unsure here. The question mentions both employee eligibility and specific purchased products, so I'm not sure if Accounts and Service Contracts fully cover both requirements.

Kayleigh 1 year ago

Wait, I'm confused. Aren't battery and assault the same thing? How are they different in the context of security work? I better re-read the question carefully.

Isaca CISA Exam - Topic 9 Question 18 Discussion