CRISC · Question #61
When documenting a risk response, which of the following provides the STRONGEST evidence to support the decision?
The correct answer is C. IT audit follow-up responses. IT audit follow-up responses provide the strongest evidence for a documented risk response because they offer independent verification and validation of actions taken.
Question
When documenting a risk response, which of the following provides the STRONGEST evidence to support the decision?
Options
- AVerbal majority acceptance of risk by committee
- BList of compensating controls
- CIT audit follow-up responses
- DA memo indicating risk acceptance
How the community answered
(14 responses)- A7% (1)
- C86% (12)
- D7% (1)
Why each option
IT audit follow-up responses provide the strongest evidence for a documented risk response because they offer independent verification and validation of actions taken.
Verbal acceptance is transient and lacks the formal, documented nature required for strong evidence in a risk management context.
A list of compensating controls outlines planned or implemented measures, but doesn't inherently provide evidence of the decision's efficacy or ongoing validation without further review.
IT audit follow-up responses offer independent, objective verification that the implemented risk response actions have been reviewed and validated for effectiveness, providing concrete evidence of adherence and outcome.
A memo indicating risk acceptance documents a decision, but does not provide independent verification or follow-up on the actual implementation or effectiveness of the risk response.
Concept tested: Risk response evidence validation
Topics
Community Discussion
No community discussion yet for this question.