Exam CRISC topic 1 question 829 discussion

I won't choose C because Audit findings are only part of the security metrics to be reported, there are broader range of risk reporting need to be covered by the organisational reporting process

A. Organizational reporting process. For risk and security metrics to be effectively reported and understood by stakeholders, it's crucial to have an established organizational reporting process. This process provides a structured and consistent manner to convey information, ensuring that key stakeholders receive relevant data in a timely and comprehensible manner, aiding in informed decision-making. While the other options are relevant to various aspects of risk management and security, they don't directly ensure the effectiveness of metrics reporting as the organizational reporting process does.

A. Organizational reporting process. Having an organized reporting process ensures that there's a systematic, consistent, and repeatable method to capture, analyze, and present risk and security metrics. This contributes directly to the effectiveness of the metrics reporting, ensuring that data is collected and reported in a manner that facilitates understanding and decision-making.

Audit is assurance, right? Going with C.

The best way to verify a control is by testing or auditing it.

How to check effectiveness of control, through audit only, rest are control inplace. Hence C.

I think that B is correct. ‍How many times has an attacker breached your information assets or networks?

c only I can think of , no other option close to the right choice

C i think ninjas