nerdexam
Isaca

CRISC · Question #533

A key performance indicator (KPI) shows that a process is operating inefficiently, even though no control issues were noted during the most recent risk assessment. Which of the following should be…

The correct answer is B. Recalibrate the key performance indicator (KPI). If a KPI indicates inefficiency despite no noted control issues in a recent risk assessment, the initial step should be to verify the KPI's accuracy and relevance to ensure it is correctly measuring the process.

Submitted by weili_xi· Apr 18, 2026Risk Response and Reporting

Question

A key performance indicator (KPI) shows that a process is operating inefficiently, even though no control issues were noted during the most recent risk assessment. Which of the following should be done FIRST?

Options

  • AImplement new controls.
  • BRecalibrate the key performance indicator (KPI).
  • CRedesign the process.
  • DRe-evaluate the existing control design.

How the community answered

(42 responses)
  • A
    21% (9)
  • B
    60% (25)
  • C
    7% (3)
  • D
    12% (5)

Why each option

If a KPI indicates inefficiency despite no noted control issues in a recent risk assessment, the initial step should be to verify the KPI's accuracy and relevance to ensure it is correctly measuring the process.

AImplement new controls.

Implementing new controls would be premature since the issue might lie with the KPI, not necessarily with the process or existing controls.

BRecalibrate the key performance indicator (KPI).Correct

When a KPI shows a process is inefficient but risk assessments find no control issues, it suggests a potential misalignment or inaccuracy in the KPI itself. Recalibrating or re-evaluating the KPI ensures that it is measuring the right metrics and thresholds correctly before making assumptions about the process or controls.

CRedesign the process.

Redesigning the process is a significant undertaking and should only be considered after confirming that the KPI is accurate and the inefficiency is indeed real, not an artifact of mismeasurement.

DRe-evaluate the existing control design.

Re-evaluating existing control design would be appropriate if the risk assessment indicated control issues, but the question states "no control issues were noted."

Concept tested: KPI validation and troubleshooting

Topics

#Key Performance Indicators (KPIs)#Risk Monitoring#Control Effectiveness#Discrepancy Resolution

Community Discussion

No community discussion yet for this question.

Full CRISC Practice