Control Design and Implementation CRISC Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is a typical step in the exemption management process?

   • AGranting the exemption without documentation
   • BApproving the exemption without a formal request
   • CRequesting, approving, and monitoring the exemption
   • DMonitoring the exemption only after it expires
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Why is it important for controls to be aligned with business objectives?

   • ATo satisfy regulatory requirements
   • BTo reduce the cost of control implementation
   • CTo ensure controls support the achievement of organizational goals
   • DTo make controls more difficult to bypass
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company has a control requiring all software to be patched within 30 days of release. A critical business application cannot be patched within this timeframe because the vendor has not yet released a compatible patch. The application owner requests a deviation from the control. What is the most appropriate classification and action?

   • AGrant an exception for a defined period, with a plan to patch when the vendor releases a compatible patch
   • BAccept the risk without documentation
   • CDeny the request and require the application to be patched immediately
   • DGrant an exemption because the vendor does not support patching
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which control testing method provides the strongest evidence that a control is operating effectively?

   • AInquiry
   • BObservation
   • CRe-performance
   • DInspection
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   How should findings be communicated to stakeholders for remediation?

   • AOnly after remediation is complete
   • BThrough informal channels to avoid formal documentation
   • COnly to the audit committee, as they are the sole decision-makers
   • DIn a clear and timely manner, tailored to the audience's needs
   Reveal Solution Discussion Select an answer first