Discuss Isaca Cybersecurity-Audit-Certificate Exam Topic 2 Question 60

A cybersecurity audit reveals that an organization's risk management function has the right to overrule business management decisions. Would the IS auditor find this arrangement acceptable?

ANo, because the risk management function should be the body that makes risk-related decisions for the organization.

BYes, because the second line of defense is generally on a higher organizational level than the first line.

CNo, because the risk management's oversight function would potentially lose its ability to objectively monitor and measure the business.

DYes, because this arrangement ensures adequate oversight and enforcement of risk management in the organization.

Suggested Answer: C

The role of risk management is to provide an oversight function, ensuring that the business management's decisions align with the organization's risk appetite and strategy. If the risk management function were to overrule business management decisions, it could compromise its objectivity. This could lead to a conflict of interest and diminish the function's ability to provide unbiased oversight and measurement of business activities.

Get Premium Cybersecurity-Audit-Certificate Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

12 comments · newest first

Trina 3 days ago

C resonates with me. Objectivity is key for effective monitoring.

Bernardine 8 days ago

I lean towards B. Higher level means better oversight, right?

Carolynn 13 days ago

I think option A makes sense. Risk management should guide, not control.

Stefania 18 days ago

But what if the risk management team doesn't understand the business side?

Nikita 24 days ago

A clear no for me, option A is spot on!

Eun 29 days ago

Isn't it weird that risk management can overrule business decisions?

Sherman 1 month ago

Totally disagree, option D is the way to go!

Lennie 1 month ago

I think option C makes a lot of sense.

Santos 1 month ago

I can see both sides, but I lean towards the idea that having risk management overrule could actually help enforce compliance. It’s a tricky balance!

Louvenia 2 months ago

I'm not entirely sure, but I feel like the second line of defense should support the first line, not override it. That could create confusion in decision-making.

Lili 2 months ago

I think I saw a similar question in our practice exams. If risk management has too much power, it might compromise their objectivity, right?

Evangelina 2 months ago

I remember discussing how the risk management function should ideally advise rather than overrule business decisions. It seems like that would lead to conflicts.

Isaca Cybersecurity-Audit-Certificate Exam - Topic 2 Question 60 Discussion