CRISC · Question #351
A migration from an in-house developed system to an external cloud-based solution is affecting a previously rated key risk scenario related to payroll processing. Which part of the risk register shoul
The correct answer is B. Payroll system risk mitigation plans. When a significant change impacts a key risk scenario, the immediate priority is to update the plans detailing how the organization will address or reduce that specific risk in the new environment.
Question
A migration from an in-house developed system to an external cloud-based solution is affecting a previously rated key risk scenario related to payroll processing. Which part of the risk register should be updated FIRST?
Options
- APayroll system risk factors
- BPayroll system risk mitigation plans
- CPayroll process owner
- DPayroll administrative controls
How the community answered
(27 responses)- A11% (3)
- B74% (20)
- C11% (3)
- D4% (1)
Why each option
When a significant change impacts a key risk scenario, the immediate priority is to update the plans detailing how the organization will address or reduce that specific risk in the new environment.
Payroll system risk factors describe the potential causes or contributors to risk, which would be updated after recognizing the new mitigation needs.
Migrating to a cloud-based solution inherently changes the attack surface and control mechanisms, requiring an immediate reassessment and update of the existing risk mitigation strategies to ensure the payroll process remains secure and compliant in the new environment.
The payroll process owner might change or be reaffirmed, but this is not the first part of the risk register to update regarding a key risk scenario change.
Payroll administrative controls are specific measures, which would be refined as part of updated mitigation plans, not the first element to update in the register.
Concept tested: Risk register update priorities
Topics
Community Discussion
No community discussion yet for this question.