An IT risk practitioner has been asked to regularly report on the overall status and effectiveness of the IT risk management program. Which of the following is MOST useful for this purpose?
正解: A
A balanced scorecard is a strategic management tool that helps to measure and communicate the performance of an organization or a program against its goals and objectives. A balanced scorecard typically consists of four perspectives: financial, customer, internal process, and learning and growth. Each perspective has a set of key performance indicators (KPIs) that reflect the critical success factors and desired outcomes of the organization or the program1. A balanced scorecard is most useful for reporting on the overall status and effectiveness of the IT risk management program, because it can provide a comprehensive and balanced view of the program's performance across multiple dimensions. A balanced scorecard can help to align the IT risk management program with the business strategy and vision, and to demonstrate the value and impact of the program to the stakeholders. A balanced scorecard can also help to identify the strengths and weaknesses of the IT risk management program, and to monitor and improve the program's processes and outcomes2. The other options are not as useful as a balanced scorecard for reporting on the overall status and effectiveness of the IT risk management program. A capability maturity level is a measure of the maturity and quality of a process or a practice, based on a predefined set of criteria and standards. A capability maturity level can help to assess and benchmark the IT risk management program's processes and practices, but it does not provide a holistic view of the program's performance and results3. An internal audit plan is a document that outlines the scope, objectives, and methodology of an internal audit activity. An internal audit plan can help to evaluate and verify the IT risk management program's controls and compliance, but it does not provide a strategic view of the program's goals and outcomes4. A control self-assessment (CSA) is a technique that involves the participation of the process owners and the staff in assessing the effectiveness and efficiency of their own controls. A CSA can help to enhance the awareness and ownership of the IT risk management program's controls, but it does not provide an objective and independent view of the program's performance and impact. References * Balanced Scorecard Basics - Balanced Scorecard Institute * Using the Balanced Scorecard to Measure and Manage IT Risk * Capability Maturity Model Integration (CMMI) Overview * Internal Audit Planning: The Basics - The IIA * [Control Self-Assessment - ISACA]
CRISC 試験問題 767
組織の在庫システムにおける冗長データに関連する最大の懸念事項は次のどれですか?
正解: C
セクション: ボリューム D
CRISC 試験問題 768
After recent updates to the risk register, management has requested that the overall level of residual risk be reduced. Which of the following is the risk practitioner's BEST course of action?
正解: D
Section: Volume D
CRISC 試験問題 769
Which of the following issues should be of GREATEST concern when evaluating existing controls during a risk assessment?
An organization that has been the subject of multiple social engineering attacks is developing a risk awareness program. The PRIMARY goal of this program should be to:
