nerdexam
Isaca

CRISC · Question #559

Which of the following would be a risk practitioner's GREATEST concern related to the monitoring of key risk indicators (KRIs)?

The correct answer is D. Logs are modified before analysis is conducted. The greatest concern regarding KRI monitoring is the modification of logs before analysis, as this compromises data integrity and renders the KRIs inaccurate and unreliable for risk assessment.

Submitted by mateo_ar· Apr 18, 2026Risk Response and Reporting

Question

Which of the following would be a risk practitioner's GREATEST concern related to the monitoring of key risk indicators (KRIs)?

Options

  • ALogs are retained for longer than required.
  • BLogs are reviewed annually.
  • CLogs are stored in a multi-tenant cloud environment.
  • DLogs are modified before analysis is conducted.

How the community answered

(43 responses)
  • A
    9% (4)
  • B
    19% (8)
  • C
    5% (2)
  • D
    67% (29)

Why each option

The greatest concern regarding KRI monitoring is the modification of logs before analysis, as this compromises data integrity and renders the KRIs inaccurate and unreliable for risk assessment.

ALogs are retained for longer than required.

Retaining logs for longer than required is a compliance and data retention issue, but it does not directly compromise the integrity or accuracy of the KRI data being analyzed.

BLogs are reviewed annually.

Reviewing logs annually means the KRI monitoring is not timely or frequent enough, but it does not inherently corrupt the accuracy of the data itself if it were to be analyzed.

CLogs are stored in a multi-tenant cloud environment.

Storing logs in a multi-tenant cloud environment poses security and privacy risks if not properly secured, but it doesn't automatically mean the logs are modified before analysis, assuming proper controls are in place.

DLogs are modified before analysis is conducted.Correct

If logs, which often serve as the data source for KRIs, are modified before analysis, their integrity is compromised, making the Key Risk Indicators inaccurate and unreliable for informed decision-making.

Concept tested: KRI data integrity

Source: https://www.isaca.org/resources/isaca-journal/issues/2021/volume-3/using-key-risk-indicators-and-key-control-indicators

Topics

#Key Risk Indicators (KRIs)#Data Integrity#Risk Monitoring#Log Management

Community Discussion

No community discussion yet for this question.

Full CRISC Practice