nerdexam
Isaca

CRISC · Question #380

A risk practitioner has been asked to assess the risk associated with a new critical application used by a financial process team that the risk practitioner was a member of two years ago. Which of…

The correct answer is D. Participation in the risk assessment may constitute a conflict of interest. The greatest concern in this scenario is a conflict of interest, as the risk practitioner's prior involvement with the financial process team could bias their assessment of the new application.

Submitted by daniela_cl· Apr 18, 2026Governance

Question

A risk practitioner has been asked to assess the risk associated with a new critical application used by a financial process team that the risk practitioner was a member of two years ago. Which of the following is the GREATEST concern with this request?

Options

  • AThe risk assessment team may be overly confident of its ability to identify issues.
  • BThe risk practitioner may be unfamiliar with recent application and process changes.
  • CThe risk practitioner may still have access rights to the financial system.
  • DParticipation in the risk assessment may constitute a conflict of interest.

How the community answered

(34 responses)
  • A
    9% (3)
  • B
    24% (8)
  • C
    6% (2)
  • D
    62% (21)

Why each option

The greatest concern in this scenario is a conflict of interest, as the risk practitioner's prior involvement with the financial process team could bias their assessment of the new application.

AThe risk assessment team may be overly confident of its ability to identify issues.

Overconfidence is a general human factor risk, but a direct conflict of interest stemming from prior involvement is a more specific and significant ethical concern in this scenario.

BThe risk practitioner may be unfamiliar with recent application and process changes.

Being unfamiliar with recent changes is a valid concern, but it's a matter of competency and due diligence (which can be mitigated by training/research) rather than an inherent ethical conflict.

CThe risk practitioner may still have access rights to the financial system.

While the practitioner *may* still have access rights, this is an access management issue that should have been addressed upon their role change, not the *greatest* concern related to their ability to perform an impartial assessment.

DParticipation in the risk assessment may constitute a conflict of interest.Correct

A risk practitioner assessing a system or process they were directly involved with previously, especially in an operational capacity, creates a significant conflict of interest. Their past involvement could lead to unconscious bias, either overlooking potential risks or favoring previous design decisions, compromising the impartiality and objectivity required for a credible risk assessment.

Concept tested: Conflict of interest in risk assessment

Source: https://www.isaca.org/credentialing/code-of-professional-ethics

Topics

#Conflict of Interest#Risk Assessment Objectivity#Ethics in Risk Management#Governance Principles

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CRISC Practice