Section: Volume D

The greatest concern for a risk practitioner reviewing current key risk indicators (KRIs) is that the KRIs' source data lacks integrity, as this means that the data is inaccurate, incomplete, inconsistent, or outdated, and therefore cannot provide reliable and valid information on the risk level and performance. The KRIs are metrics that measure and monitor the changes in the risk exposure and the effectiveness of the risk response over time. The KRIs' source data should be collected and verified from credible and relevant sources, and should be updated and maintained regularly. The KRIs' source data should also be aligned and integrated with the enterprise's data governance and quality standards. The other options are not the greatest concerns for a risk practitioner reviewing current key risk indicators (KRIs), although they may pose some challenges or limitations. The KRIs are not automated is a concern for the efficiency and timeliness of the KRI reporting and analysis, but it does not affect the integrity of the KRI source data. The KRIs are not quantitative is a concern for the objectivity and comparability of the KRI measurement and prioritization, but it does not affect the integrity of the KRI source data. The KRIs do not allow for trend analysis is a concern for the usefulness and relevance of the KRI communication and decision making, but it does not affect the integrity of the KRI source data. References = Risk and Information Systems Control Study Manual, Chapter 5: Risk and Control Monitoring and Reporting, page 183.

IT リスク管理委員会の効果的な意思決定を確実に行うための最良の方法は、主要な利害関係者をメンバーとして登録することです。主要な利害関係者とは、ビジネス オーナー、上級管理職、IT マネージャー、監査人、規制当局、顧客、サプライヤーなど、IT リスク管理プロセスに関心または影響力を持つ個人またはグループです。主要な利害関係者を IT リスク管理委員会に参加させることで、委員会は彼らの多様な視点、専門知識、経験から恩恵を受けることができ、IT リスク管理の決定がビジネス目標、優先事項、期待に沿ったものになることを保証できます。主要な利害関係者は、IT リスク管理活動に対する貴重な意見、フィードバック、サポートも提供し、組織全体で IT リスク管理の決定を伝え、実装するのに役立ちます。参考文献 = CRISC レビュー マニュアル、第 6 版、ISACA、2015 年、36 ページ。