nerdexam
Isaca

CRISC · Question #358

Which of the following is the BEST response when a potential IT control deficiency has been identified?

The correct answer is B. Verify the deficiency and then notify the business process owner. Upon identifying a potential IT control deficiency, the best initial step is to confirm its validity and then inform the business process owner, who is ultimately responsible for the control's effectiveness.

Submitted by lucia.co· Apr 18, 2026Risk Response and Reporting

Question

Which of the following is the BEST response when a potential IT control deficiency has been identified?

Options

  • ARemediate and report the deficiency to the enterprise risk committee.
  • BVerify the deficiency and then notify the business process owner.
  • CVerify the deficiency and then notify internal audit.
  • DRemediate and report the deficiency to senior executive management.

How the community answered

(32 responses)
  • A
    6% (2)
  • B
    91% (29)
  • D
    3% (1)

Why each option

Upon identifying a potential IT control deficiency, the best initial step is to confirm its validity and then inform the business process owner, who is ultimately responsible for the control's effectiveness.

ARemediate and report the deficiency to the enterprise risk committee.

Remediation should happen after verification and consultation with the owner; reporting to a committee prematurely might be inefficient or based on unverified information.

BVerify the deficiency and then notify the business process owner.Correct

Before taking any further action, it is crucial to verify that the identified control deficiency is accurate and legitimate; once confirmed, the business process owner must be notified as they are accountable for the process and controls, enabling them to understand the issue and initiate appropriate corrective actions.

CVerify the deficiency and then notify internal audit.

While internal audit may eventually need to be involved, the immediate responsibility for the control typically lies with the business process owner.

DRemediate and report the deficiency to senior executive management.

Remediation without verification and direct engagement with the owner is premature, and reporting to senior executive management is typically an escalation step for significant, unaddressed issues, not the first response to a potential deficiency.

Concept tested: IT control deficiency response

Topics

#Control deficiency#Notification#Business process owner#Risk identification

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CRISC Practice