IT asset inventory is the process of tracking and managing the financial, physical, licensing, and contractual aspects of IT assets throughout their life cycle1. IT assets include hardware, software, and network components that an organization values and uses to achieve its objectives2. A complete and accurate IT asset inventory can help an organization to optimize its IT budget, reduce security risks, ensure compliance, and improve performance3.
One of the best controls to enable an organization to ensure a complete and accurate IT asset inventory is performing network scanning for unknown devices. Network scanning is the process of identifying and collecting information about the devices connected to a network, such as their IP addresses, operating systems, open ports, services, and vulnerabilities4. Network scanning can help an organization to:
* Discover and inventory all the IT assets on the network, including those that are unauthorized,
* unmanaged, or hidden
* Detect and remove any rogue or malicious devices that may pose a threat to the network security or performance
* Update and verify the asset inventory data regularly and automatically, and alert on any changes or discrepancies
* Support the asset lifecycle management and maintenance activities, such as patching, upgrading, or retiring assets5 References = IT Asset Valuation, Risk Assessment and Control Implementation Model, ITAM: The ultimate guide to IT asset management, Navigating Security Threats with IT Inventory Management, Network Scanning - Wikipedia, 8 Best IT Asset Management Software (2024)

Residual risk is the risk that remains after the risk response has been implemented. Risk tolerance is the acceptable level of variation from the desired outcome or objective. If the residual risk is within the risk tolerance, it means that the risk response has been effective in reducing the risk to an acceptable level.
References
*ISACA CRISC Review Manual, 7th Edition, Domain 3: Risk Response, Section 3.1.1: Residual Risk
*Residual Risk: Definition, Formula & Management - Video & Lesson Transcript | Study.com
*Risk Tolerance - ISACA

セクション: ボリューム D
Explanation:
主要業績評価指標は、企業や業界が戦略目標や運用目標の達成という観点からパフォーマンスを測定または比較するために使用する、定量化可能な一連の尺度です。主要業績評価指標 (KPI) は、監視するコンセプトや機能の運用上の有効性に関する洞察を提供します。
誤った回答:
A: 主要リスク指標 (KRI) は、監視対象の概念または機能内で存在または実現される可能性のある潜在的なリスクに関する洞察のみを提供します。
B: 能力成熟度モデル (CMM) は、概念または能力の成熟度を評価するものであり、運用の有効性に関する洞察は提供しません。
D: メトリックしきい値は、KPI または KRI が特定の値または値のセットを報告したときに実行される決定ポイントまたはアクション ポイントです。

is incorrect. Business process owners typically cannot effectively identify risk to their business processes. They may not have the ability to be unbiased and may not have the appropriate skills or tools for evaluating risks. Answer:B is incorrect. Audit personnel may not have the appropriate business knowledge in risk assessment, hence cannot properly identify risk. Regular audits may also cause hindrance to the business activities. Answer:D is incorrect. Monitoring key risk indicators, and record the findings in the risk register will only provide insights to known and identified risk and will not account for obscure risk, i.e. , risk that has not been identified yet.