Exam CISA topic 1 question 717 discussion

Actual exam question from Isaca's CISA

Question #: 717
Topic #: 1

During an audit of an organization's risk management practices, an IS auditor finds several documented IT risk acceptances have not been renewed in a timely manner after the assigned expiration date. When assessing the severity of this finding, which mitigating factor would MOST significantly minimize the associated impact?

A. There are documented compensating controls over the business processes.
B. The risk acceptances with issues reflect a small percentage of the total population.
C. The business environment has not significantly changed since the risk acceptances were approved.
D. The risk acceptances were previously reviewed and approved by appropriate senior management.

Show Suggested Answer

Suggested Answer: C 🗳️

by Jag127 at Feb. 13, 2023, 9:16 a.m.

Comments

Submit Cancel

Jag127

Highly Voted 2 years, 5 months ago

Selected Answer: C

You should check whether there are changes to the business environment then check whether the compensating controls are still effective.

upvoted 5 times

...

maxson69

Most Recent 1 month, 3 weeks ago

Selected Answer: C

Option C because it directly addresses the validity of the original risk acceptance, thereby minimising potential impact.

upvoted 1 times

...

9967be3

3 months, 1 week ago

Selected Answer: A

It can not be answer C because unchanged business environment helps justify delays but doesn’t mitigate active threats.

upvoted 1 times

...

pLulu

8 months, 2 weeks ago

C. If the business environment remains largely unchanged, the risks identified and accepted previously are likely still relevant and the controls in place may still be effective. This stability reduces the urgency and potential impact of not renewing the risk acceptances on time.

upvoted 2 times

...

RS66

1 year ago

C. The business environment has not significantly changed since the risk acceptances were approved.

upvoted 3 times

...

a84n

1 year, 3 months ago

Selected Answer: D

Answer D Option D emphasizes that the risk acceptances were previously reviewed and approved by appropriate senior management. This suggests that the risks were assessed and accepted at a higher level of authority, providing a level of assurance that the risks were understood and acknowledged by the organization's leadership. Therefore, in this context, Option D represents a more significant mitigating factor.

upvoted 1 times

...