CRISC · Question #244
When confirming whether implemented controls are operating effectively, which of the following is MOST important to review?
The correct answer is C. Number of emergency change requests. Reviewing the number of emergency change requests is most important for confirming control effectiveness, as an increase often signals control failures or insufficient design.
Question
When confirming whether implemented controls are operating effectively, which of the following is MOST important to review?
Options
- AResults of benchmarking studies
- BResults of risk assessments
- CNumber of emergency change requests
- DMaturity model
How the community answered
(50 responses)- A4% (2)
- B6% (3)
- C74% (37)
- D16% (8)
Why each option
Reviewing the number of emergency change requests is most important for confirming control effectiveness, as an increase often signals control failures or insufficient design.
Benchmarking studies compare an organization's performance against others, which is useful for identifying areas for improvement, but less direct for confirming the operational effectiveness of currently implemented controls.
Results of risk assessments identify potential risks and control gaps but do not directly confirm the operational effectiveness of controls that have already been implemented.
An increase in emergency change requests often indicates that existing controls failed to prevent issues, or that routine processes and controls are insufficient, necessitating urgent fixes outside standard procedures. This directly reflects on the operational effectiveness of implemented controls.
A maturity model assesses the sophistication and capability of processes over time but does not provide specific, immediate insight into the operational effectiveness of individual controls.
Concept tested: Measuring control effectiveness via operational indicators
Topics
Community Discussion
No community discussion yet for this question.