MENU
After a high-profile systems breach at an organization s key vendor, the vendor has implemented additional mitigating controls. The vendor has voluntarily shared the following set of assessments:
After a high-profile systems breach at an organization s key vendor, the vendor has implemented additional mitigating controls. The vendor has voluntarily shared the following set of assessments:
Which of the assessments provides the MOST reliable input to evaluate residual risk in the vendor's control environment?
Suggested Answer: B
Get Premium CRISC Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
12 comments · newest first
LE
Lelia
11 months ago
Regulatory exams usually miss a lot of details, right?
JA
Jamal
12 months ago
Wait, why is the vendor performance scorecard even an option?
CA
Cathrine
12 months ago
Not so sure about that, internal audits can be just as effective.
JU
Julianna
12 months ago
Totally agree, external audits are thorough!
KR
Kris
1 year ago
I think the external audit is the most reliable.
BO
Bok
1 year ago
Regulatory examinations are thorough, but I feel like they might not reflect the current state of controls as well as an internal audit would.
BR
Brendan
1 year ago
The vendor performance scorecard seems like it could give insights into ongoing performance, but I wonder if it captures all the risks effectively.
MA
Maynard
1 year ago
I think internal audits might be more relevant since they focus on the vendor's specific environment, but I can't recall the exact details.
TA
Tayna
1 year ago
I remember we discussed how external audits can provide an objective view of controls, but I'm not sure if they are the most reliable for residual risk.
LE
Lera
1 year ago
This seems like a straightforward question. I think the Citrix Director tool would be the best option to extract the required information for the upgrade.
SH
Shenika
1 year ago
Hmm, this is a tricky one. I'm not entirely sure about the nuances of corporate governance, but I think the answer might be C since it mentions "independent challenge and rigour in strategic development," which sounds like a good governance practice.
DO
Dorothy
1 year ago
My notes said something about the need for transparency with those in charge, especially if there are issues identified during the audit. Is that part of this?