Isaca CRISC Exam - Topic 1 Question 37 Discussion

Actual exam question for Isaca's CRISC exam

Question #: 37
Topic #: 1

An organization is considering outsourcing user administration controls tor a critical system. The potential vendor has offered to perform quarterly sett-audits of its controls instead of having annual independent audits. Which of the following should be of GREATEST concern to me risk practitioner?

AThe controls may not be properly tested

BThe vendor will not ensure against control failure

CThe vendor will not achieve best practices

DLack of a risk-based approach to access control

Show Suggested Answer

Suggested Answer: A

by Lashon at May 03, 2022, 10:35 PM

Limited Time Offer

25%

Off

Get Premium CRISC Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Ressie

4 months ago

Not sure about this vendor's reliability, seems like a gamble.

upvoted 0 times

...

Roy

4 months ago

Best practices are crucial, but I think quarterly could work if done right.

upvoted 0 times

...

Hana

4 months ago

Wait, are they really going to skip the annual audits? That’s a huge red flag!

upvoted 0 times

...

Mose

4 months ago

I agree, annual audits are way more thorough.

upvoted 0 times

...

Johana

5 months ago

Quarterly audits sound risky, not enough time to catch issues.

upvoted 0 times

...

Reena

5 months ago

I practiced a question similar to this, and I think the lack of a risk-based approach, option D, could really compromise security.

upvoted 0 times

...

Shannon

5 months ago

I'm not entirely sure, but I think option B could be a big issue since control failures could lead to serious risks.

upvoted 0 times

...

Joanna

5 months ago

I remember discussing how quarterly audits might not be as thorough as annual ones, so I'm leaning towards option A.

upvoted 0 times

...

Brice

5 months ago

I feel like best practices are important, but I'm not confident if that's the biggest concern here. Maybe option C isn't the main issue?

upvoted 0 times

...

Carin

5 months ago

Okay, this is a tricky one. I'll need to really dive into the numbers and think critically about which company has the "worst" ratios compared to the others. Gotta stay focused and not get bogged down in the details.

upvoted 0 times

...

Rikki

5 months ago

Verifiability seems like the most likely answer here. We need to be able to independently verify the information, so that would require the most agreement.

upvoted 0 times

...

Tori

5 months ago

I'm a bit confused by this question. The code doesn't seem to be provided, so it's hard to know exactly what the issue is. I'll have to think through the different options and try to determine which one would resolve the compilation error.

upvoted 0 times

...

Cyndy

5 months ago

I'm a little confused on this one. Is the change log the right answer, or is it something else like the issue log or change requests? I'll have to think it through carefully.

upvoted 0 times

...