Isaca CRISC - Certified in Risk and Information Systems Control

 Emerging risk is a risk that is new or evolving, and has the potential to significantly affect the enterprise’s objectives, performance, or reputation. Emerging risk can arise from changes in the internal or external environment, such as technological innovations, regulatory developments, or social trends. The best way to support communication of emerging risk is to include it on the next enterprise risk committee agenda. The enterprise risk committee is a group of senior executives who oversee the enterprise-wide risk management program, and provide guidance and direction to the risk owners and practitioners. By including the emerging risk on the agenda, the risk practitioner can ensure that the enterprise risk committee is aware of the risk, its causes, impacts, and likelihood, and can decide on the appropriate risk response strategy and actions. The other options are not the best way to support communication of emerging risk, as they involve different aspects of the risk management process:

Update residual risk levels to reflect the expected risk impact means that the risk practitioner adjusts the risk levels after considering the existing or planned risk responses. This may not befeasible or accurate for emerging risk, as the risk responses may not be defined or implemented yet, or may not be effective for the new or evolving risk.

Adjust inherent risk levels upward means that the risk practitioner increases the risk levels before considering any risk responses. This may not reflect the true nature or magnitude of the emerging risk, as the inherent risk levels are based on the assumptions and estimates of the risk practitioner, and may not account for the uncertainties or complexities of the emerging risk.

Include it in the risk register for ongoing monitoring means that the risk practitioner records and tracks the emerging risk, its causes, impacts, likelihood, responses, and owners. This is an important step in the risk management process, but it does not necessarily support communication ofthe emerging risk, as the risk register may not be accessible or visible to all the relevant stakeholders, or may not be updated or reviewed frequently enough to capture the changes in the emerging risk. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 1, Section 1.2.2.2, pp. 21-22.

The primary purpose of creating and documenting control procedures is to help manage risk to acceptable tolerance levels. Control procedures are the specific actions or steps that are performed to achieve the control objectives and mitigate the risks. Control procedures should be documented to provide clear guidance, consistency, and accountability for the control activities. Documenting control procedures also helps to monitor and evaluate the effectiveness andefficiency of the controls, and to identify and address any gaps or weaknesses. The other options are not the primary purpose of creating and documenting control procedures, although they may be secondary benefits or outcomes. References = Risk and Information Systems Control Study Manual, Chapter 1, Section 1.3.2, page 1-15.

According to the Gaining the competitive edge – measuring and assessing an organization’s risk culture article, risk appetite is the amount and type of risk that an organization is willing to accept in pursuit of its objectives. Risk appetite should be aligned with the organization’s strategy, goals, and values, and should reflect the organization’s risk culture and capabilities. One of the main considerations when validating an organization’s risk appetite is the capacity to withstand loss, which is the ability of the organization to absorb the impact of adverse events without jeopardizing its viability or reputation. The capacity to withstand loss depends on various factors, such as the financial strength, the operational resilience, the governance structure, and the stakeholder expectations of the organization. By assessing the capacity to withstand loss, the organization can determine if its risk appetite is realistic and appropriate, or if it needs to be adjusted to match its risk profile and environment. References = Gaining the competitive edge – measuring and assessing an organization’s risk culture

A security policy exception is a deviation from the established security policy that is granted to an individual or a group for a specific purpose or period of time. A security policy exception may be necessary when the security policy is too restrictive, outdated, or incompatible with the business requirements or objectives. However, a security policy exception also introduces a risk to the organization, as it may weaken the security posture, expose the organization to threats orvulnerabilities, or violate the compliance or regulatory obligations. Therefore, an upward trend in the number of security policy exceptions approved should be of most concern, as it indicates that the security policy is not effective or aligned with the organization’s needs and goals, and that the organization is accepting more risk than desired. The other options are not as concerning as the number of security policy exceptions approved, because they do not imply a direct or immediate risk to the organization, but rather reflect the normal or expected activities of the security management process, as explained below:

A. Number of business change management requests is a metric that measures the volume and frequency of the requests to modify the business processes, systems, or functions. An upward trend in this metric may indicate that the organization is undergoing a transformation, innovation, or improvement, which may have positive or negative impacts on the organization’s performance and security. However, this metric does not necessarily imply a risk to the organization, as the change management requests may be properly assessed, approved, and implemented, following the established change management procedures and controls.

B. Number of revisions to security policy is a metric that measures the amount and extent of the changes made to the security policy over time. An upward trend in this metric may indicate that the security policy is being updated, refined, or enhanced, which may improve or maintain the security posture and compliance of the organization. However, this metric does not necessarily imply a risk to the organization, as the revisions to the security policy may be based on the best practices, standards, and expectations for security management, and may be communicated and enforced effectively across the organization.

D. Number of changes to firewall rules is a metric that measures the number and type of the modifications made to the firewall configuration, which controls the incoming and outgoing network traffic based on predefined rules. An upward trend in this metric may indicate that the firewall is being adjusted, optimized, or customized, which may increase or decrease the firewall performance and security. However, this metric does not necessarily imply a risk to the organization, as the changes to the firewall rules may be justified, authorized, and validated,following the established firewall management procedures and controls. References = Risk and Information Systems Control Study Manual, Chapter 4, Section 4.2.1, page 115. Security Policy Exceptions: What Are They and How to Manage Them, Security Policy Exceptions: How to Handle Them in a Secure Manner, Security Policy Exceptions: A Necessary Evil?

The most important thing for a risk practitioner to ensure once a risk action plan has been completed is that the risk owner has validated the outcomes, as this means that the risk owner has confirmed that the risk response has been implemented and that the risk level has been reduced to an acceptable level. The risk owner is the person or entity with the authority and responsibility to manage a particular risk, and they should evaluate the effectiveness and efficiency of the risk action plan, and report any issues or changes. The risk action plan is a document that outlines the specific actions, resources, responsibilities, and timelines for implementing a risk response. The other options are not the most important things for a risk practitioner to ensure once a risk action plan has been completed, although they may be useful or necessary steps. Updating the risk register is a good practice, but it should be done after the risk owner hasvalidated the outcomes and with the consent of the risk owner. Mapping the control objectives to the risk objectives is a part of the risk response design, but it does not measure the actual achievement of the risk objectives. Achieving the requirements is a desired result, but it does not guarantee that the risk owner has validated the outcomes or that the risk level has been reduced to an acceptable level. References = Risk and Information Systems Control Study Manual, Chapter 4: Risk Response, page 146.

Capacity management is crucial when transitioning employees to remote work during a crisis. It involves ensuring that the IT infrastructure can handle increased loads and that resources are available to support remote operations effectively.

Conducting vulnerability scans is the best way for a risk practitioner to validate the effectiveness of a patching program. Vulnerability scans are automated tools that identify and report on the vulnerabilities in a system or network, such as missing patches, misconfigurations, or outdated software. Vulnerability scans can help the risk practitioner to verify that the patches have been applied correctly and consistently, and that there are no remaining or new vulnerabilities that need to be addressed. Conducting penetration testing, interviewing IT operations personnel, and reviewing change control board documentation are also useful methods to evaluate the patching program, but they are not as comprehensive, objective, or timely as vulnerabilityscans. References = Risk and Information Systems Control Study Manual, Chapter 2, Section 2.3.3, page 2-28.

Business Impact Analysis (BIA):

Purpose: A BIA is a systematic process to evaluate the potential effects of an interruption to critical business operations as a result of a disaster, accident, or emergency.

Identification of Consequences: It identifies critical resources and the consequences of their loss, allowing an organization to determine the operational and financial impacts of such losses.

Steps Involved in BIA:

Identify Critical Functions: Determine which business functions and processes are essential to the organization's operations.

Assess Impact: Evaluate the impact of losing these functions on the organization’s ability to operate.

Estimate Downtime Tolerance: Determine the maximum allowable downtime for critical functions before significant harm occurs.

Identify Dependencies: Document dependencies between systems, processes, and resources to understand how disruptions to one part affect the whole.

Comparison with Other Options:

Risk Management Action Plans: These are detailed plans developed to address identified risks but do not specifically focus on the impact of losing critical resources.

What-if Technique: This is a brainstorming technique used to explore potential risks and their impacts but is not as structured as a BIA.

Tabletop Exercise Results: These exercises simulate disaster scenarios to test response plans but do not provide the comprehensive impact analysis that a BIA does.

Best Practices:

Regular Updates: Regularly update the BIA to reflect changes in the business environment and operational dependencies.

Integration with DR/BC Plans: Ensure that findings from the BIA are integrated into disaster recovery (DR) and business continuity (BC) plans to enhance overall preparedness.

Risk transfer is a risk response strategy that involves shifting the responsibility or burden of a risk to another party, such as a third party, an insurance company, or a joint venture. Risk transfer does not eliminate the risk, but it reduces the exposure or impact of the risk to the enterprise. An example of risk transfer is engaging a third party to provide an Internet gateway encryption service that protects sensitive data uploaded to a cloud service. By doing so, the organization transfers the risk of data breach or loss to the third party, who is responsible for ensuring the security and availability of the data. The other options are not examples of risk transfer, as they involve different risk response strategies:

Risk mitigation is a risk response strategy that involves reducing the likelihood or impact of a risk to an acceptable level, such as by implementing controls, policies, or procedures.

Risk avoidance is a risk response strategy that involves eliminating the risk by not performing the activity that generates the risk, such as by discontinuing a product or service, or not entering a market.

Risk acceptance is a risk response strategy that involves acknowledging the risk and taking no action to address it, such as by tolerating the risk, exploiting the risk, or sharing the risk. References =Risk and Information Systems Control Study Manual, 7th Edition, Chapter 3, Section 3.3.1.1, pp. 107-108.

The primary focus of an ongoing risk awareness program should be to enable better risk-based decisions, as this can help the organization to achieve its objectives, optimize its performance, and manage its risks effectively. An ongoing risk awareness program is a process of educating, communicating, and engaging the stakeholders about the organization’s risk management framework, methodology, and practices. An ongoing risk awareness program can help the stakeholders to understand the risk context, criteria, appetite, and profile of the organization, and to identify, assess, treat, monitor, and review the risks that may affect their roles and responsibilities. By doing so, an ongoing risk awareness program can empower the stakeholders to make informed and rational decisions that balance the benefits and costs of risk-taking, and that align with the organization’s strategy and goals.

Open communication of risk reporting is the most important factor for promoting a risk-aware culture, because it fosters trust, transparency, and accountability among all stakeholders. It also enables timely and informed decision-making, feedback, and learning from risk events. Regular testing of risk controls, communication of audit findings, and procedures for security monitoring are all important aspects of risk management, but they do not necessarily create a risk-aware culture, which requires a shared understanding and commitment to risk management across the organization. References = Risk and Information Systems Control Study Manual, Chapter 1, Section 1.2.2, page 1-9.

 The best evidence of an effective internal control environment is the independent audit results. Independent audit results are the outcomes or findings of an external or independent party that evaluates the design, implementation, and operation of the internal controls. Independent audit results can provide an objective, reliable, and consistent assessment of the internal control environment, and identify the strengths, weaknesses, gaps, or issues of the internal controls. Independent audit results can also provide assurance, recommendations, or improvement opportunities for the internal control environment. The other options are not as good as independent audit results, as they are related to the inputs, processes, oroutputs of the internal control environment, not the evaluation or verification of the internal controlenvironment. References = Risk and Information Systems Control Study Manual, Chapter 2: IT Risk Assessment, Section 2.3: IT Control Assessment, page 69.

According to the What To Look For When Assessing Your Organization’s Security Risk Posture article, risk appetite is the amount and type of risk that an organization is willing to accept in pursuit of its objectives. Risk appetite should be aligned with the organization’s strategy, goals, and values, and should reflect the organization’s risk culture and capabilities. When reviewing a risk response strategy, senior management’s primary focus should be placed on the alignment with risk appetite, as this indicates how well the risk response strategy supports the organization’s objectives and expectations, and how consistent it is with the organization’s risk tolerance and risk profile. By ensuring the alignment with risk appetite, senior managementcan evaluate the effectiveness and efficiency of the risk response strategy, and determine if any adjustments or improvements are needed. References = What To Look For When Assessing Your Organization’s Security Risk Posture

Risk management is the process of identifying, analyzing, evaluating, treating, monitoring, and communicating the risks that may affect the achievement of an organization’s objectives. The activity that best facilitates effective risk management throughout the organization is conducting periodic risk assessments, which are the systematic and structured methods of identifying and analyzing the potential sources and consequences of risk events. By conducting periodic risk assessments, an organization can proactively identify and prioritize the risks that pose the greatest threat or opportunity, and implement theappropriate risk responses to optimize the risk exposure and align it with the risk appetite and tolerance. References = CRISC Review Manual, 7th Edition, page 63.

Risk appetite should be primarily driven by stakeholder requirements. Stakeholder requirements are the needs and expectations of the internal and external parties that have an interest or influence in the organization’s objectives or operations, such as the board, management, employees, customers, regulators, investors, etc. Risk appetite is the amount and type of risk that the organization is willing to accept or pursue in order to achieve its objectives. Risk appetite should be driven by stakeholder requirements, because they reflect the organization’s mission, vision, values, and strategy, and they provide the basis and direction for the organization’s risk management activities. Risk appetite should also be aligned and communicated with stakeholder requirements, because they affect the organization’s performance and reputation, and they require the organization’s accountability and transparency. The other options are not the primary drivers of risk appetite, although they may be considered or influenced by risk appetite. Enterprise security architecture roadmap, legal and regulatory requirements, and businessimpactanalysis (BIA) are all factors that could affect the organization’s risk profile, risk assessment, or risk response, but they do not necessarily determine or reflect the organization’s risk appetite. References = Risk and Information Systems Control Study Manual, Chapter 2, Section 2.3.1, page 2-23.

The best way to mitigate the risk associated with infrastructure updates is to implement a change control process. A change control process is a set of procedures that ensures that any changes to the infrastructure are planned, approved, tested, implemented, and documented in a consistent and controlled manner. A change control process helps to reduce the risk of errors, conflicts, disruptions, or security breaches that could result from infrastructure updates. A change controlprocess also helps to monitor and evaluate the impact and effectiveness of the changes, and to ensure that they align with the enterprise’s objectives and requirements. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 3, Section 3.3.1, page 1391

Risk avoidance involves ceasing activities that expose the organization to significant risks, such as shutting down the sales order system. This decision aligns withRisk Treatment Strategiesaimed at eliminating exposure.

ï‚· Understanding the Question:

The question asks which method best enables timely detection of changes in the security control environment.

ï‚· Analyzing the Options:

A. Control self-assessment (CSA):Allows for continuous monitoring and quick detection of any changes or deficiencies in controls.

B. Log analysis:Useful for detecting security incidents but not as comprehensive as CSA for overall control environment changes.

C. Security control reviews:Typically periodic and might not be as timely.

D. Random sampling checks:Not as systematic or comprehensive as CSA.

ï‚·

Control Self-Assessment (CSA):CSA involves regular, structured evaluations by internal staff to ensure controls are working effectively. It promotes early detection of issues by those directly responsible for the controls.

Timeliness:CSA is an ongoing process, making it more timely in identifying changes compared to periodic reviews or random checks.

The type of risk that is most likely to materialize as a result of allowing several employees to retire early in order to avoid layoffs is institutional knowledge loss, as it represents the loss of valuable information, experience, and expertise that the employees have accumulated over time, and that may not be easily transferred or replaced. Confidentiality breach, intellectual property loss, and unauthorized access are not the most likely types of risk, as they are more related to the security, ownership, or access of information, respectively, rather than the retention or transfer of knowledge. References = CRISC Review Manual, 7th Edition, page 100.

Penetration test resultsprovide direct evidence of the vendor’s technical security posture and ability to defend against real-world attacks. This is more effective than reviewing contracts or benchmarking, which are indirect measures.

The most important factor when assessing the risk of allowing users to access company data from their personal devices is the classification of the data, as it indicates the level of sensitivity, confidentiality, and criticality of the data. Data classification helps to determine the appropriate level of protection and controls that are needed to prevent unauthorized access, disclosure, modification, or loss of the data. Data classification also helps to define the roles and responsibilities of the data owners, custodians, and users, and the acceptable use of the data. The other options are not the most important factors, although they may be relevant or influential in the risk assessment. The type of device may affect the security features and vulnerabilities of the device, but it does not determine the value or impact of the data. The remote management capabilities may affect the ability to monitor, control, or wipe the device in case of theft or loss, but they do not reflect the nature or purpose of the data. The volume of data may affect the storage capacity or performance of the device, but it does not indicate the importance or significance of the data. References = What is BYOD (Bring-Your-Own-Device) - CrowdStrike; Understanding BYOD Policy - Get Certified Get Ahead; Addressing cyber security concerns on employees’ personal devices; Personal Devices at Work – Nonprofit Risk Management Center; 10 Keys to an Effective BYOD and Remote Access Policy

The most important reason to validate that risk responses have been executed as outlined in the risk response plan is to ensure that the residual risk is at an acceptable level. Residual risk is the risk that remains after applying a risk response. The risk response plan is the document thatdescribes the actions and resources needed to address the risk. Validating the risk response execution is the process of verifying that the risk response actions have been performed as planned, and that they have achieved the desired results. Validating the risk response execution helps to measure and monitor the residual risk, and to ensure that it is within the risk tolerance of the organization and its stakeholders. The other reasons are not as important as ensuring that the residual risk is at an acceptable level, although they may be secondary benefits or outcomes of validating the risk response execution. References = Risk and Information Systems Control Study Manual, Chapter 4, Section 4.3.1, page 4-23.

A risk map, also known as a risk heat map, is a visual tool that helps an enterprise prioritize risk scenarios by plotting them on a matrix based on their likelihood and impact. A risk map can help to compare and contrast different risk scenarios, as well as to identify the most critical and urgent risks that require attention. A risk map can also help to communicate and report the risk profile and status to the stakeholders and decision makers. Therefore, the placement on the risk map would best help an enterprise prioritize risk scenarios. The other options are not the best ways to help an enterprise prioritize risk scenarios, although they may be relevant and useful. Industry best practices are the standards or guidelines that are widely accepted and followed by the organizations in a specific industry or domain. Industry best practices can help to benchmark and improve the risk management process and performance, but they may not reflect the specific risk context and needs of the enterprise. Degree of variances in the risk is the measure of the variability or uncertainty of the risk, which may affect the accuracy or reliability of the risk assessment and response. Degree of variances in the risk can help to adjust and refine the risk analysis and treatment, but it may not indicate the priority or importance of the risk. Cost of risk mitigation is the amount of resources or expenses that are required or allocated to implement the risk response actions, such as avoiding, transferring, mitigating, or accepting the risk. Cost of risk mitigation can help to evaluate and optimize therisk response options, but it may not determine the priority or urgency of the risk. References = CRISC Review Manual, pages 38-391; CRISC Review Questions, Answers & Explanations Manual, page 892

The best course of action when an organization wants to reduce likelihood in order to reduce a risk level is to implement preventive measures. Likelihood is the probability or chance of a risk occurring, and risk level is the combination of likelihood and impact of a risk. Preventive measures are controls that are designed to prevent or deter the occurrence of a risk, such as policies, standards, procedures, guidelines, etc. Implementing preventive measures is the best course of action, because it helps to reduce the likelihood of a risk, and consequently, the risk level. Implementing preventive measures also helps to protect and enhance the organization’s objectives, performance, and improvement. The other options are not the best course of action, although they may be related to the risk management process. Monitoring risk controls, implementing detective controls, and transferring the risk are all activities that can help to manage or mitigate the risks, but they do not necessarily reduce the likelihood or the risk level. References = Risk and Information Systems Control Study Manual, Chapter 4, Section 4.3.1, page 4-21.

The percentage of projects with developed controls on scope creep is the best key performance indicator (KPI) to measure how effectively risk management practices are embedded in the project management office (PMO), as it reflects the ability of the PMO to identify, assess, and respond to the risk of project scope changes that may affect the project objectives, budget, and schedule. The other options are not the best KPIs, as they do not directly measure the effectiveness of risk management practices in the PMO, but rather the outcomes or consequences of risk management decisions. References = CRISC Review Manual, 7th Edition, page 110.

According to the Guide to Implementing an IT Risk Management Framework, the first activity that should be performed when establishing IT risk management processes is to assess the goals and culture of the organization. This is because the goals and culture of the organization define the context and scope of the IT risk management process, and influence the risk appetite and tolerance of the organization. By assessing the goals and culture of the organization, the IT risk manager can align the IT risk management process with the organization’s strategy, vision, mission, values, and objectives. The IT risk manager can also identify the key stakeholders, roles, and responsibilities involved in the IT risk management process, and ensure that they have the necessary skills, knowledge, and resources to perform their tasks effectively. Additionally, the IT risk manager can establish the communication and reporting mechanisms for the IT risk management process, and ensure that they are consistent with the organization’s culture and expectations. References = Guide to Implementing an IT Risk Management Framework, An Overview of the Risk Management Process

Cybersecurity incident response procedures are the plans and actions that an organization takes to respond to and recover from a cybersecurity attack. They include identifying the source and scope of the attack, containing and eradicating the threat, restoring normal operations, and analyzing the root cause and lessons learned. Reviewing cybersecurity incident response procedures is the most effective course of action when the probability of a successful cybersecurity attack is increasing and the potential loss could exceed the organization’s risk appetite, as it helps to prepare the organization for minimizing the impact and duration of the attack, as well as improving the resilience and security posture of the organization.

The data owner is the person who has the authority and responsibility to classify, label, and protect the information assets of the organization. The data owner is accountable for the risk ofpotential loss of confidential information, as they are the ones who determine the level of protection and access required for the data. The risk manager is responsible for identifying, assessing, and mitigating the risks that may affect the organization, but they are not accountable for the data itself. The end user is the person who uses the information assets for their operational tasks, but they are not accountable for the data protection or classification. The IT department is responsible for providing the technical support and infrastructure for the information assets, but they are not accountable for the data ownership or risk management. References = Risk and Information Systems Control Study Manual, Chapter 2: IT Risk Assessment, Section 2.3: Data Classification, p. 69-70.

 When reporting risk assessment results to senior management, the most important information to include to enable risk-based decision making is the potential losses compared to treatment cost. This information helps to quantify the impact and likelihood of the risks, and to evaluate the cost and benefit of the risk responses. This information also helps to prioritize and allocate resources for the risk management program, and to align the risk management program with the enterprise’s objectives, strategy, and risk appetite. The other options are not as important as the potential losses compared to treatment cost, as they provide different types of information for the risk management process:

Risk action plans and associated owners are the documents that specify the actions to be taken to address the identified risks, the resources required, the timelines, the owners, and the expected outcomes. This information helps to implement and monitor the risk management program, and to assign the authority and accountability for the risk management activities.

Recent audit and self-assessment results are the outcomes of the independent and objective examination of the risk management program, such as by internal or external auditors, or by the risk owners or practitioners themselves. This information helps to provide assurance and feedback on the effectiveness and efficiency of the risk management program, and to identify the gaps or weaknesses that need to be addressed.

A list of assets exposed to the highest risk are the resources that have the most value for the enterprise, such as hardware, software, data, or services, and that are affected by or contribute to the highest risks. This information helps to identify and protect the critical assets of theenterprise, and to reduce the exposure and impact of the risks to the assets. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 2, Section 2.3.1.1, pp. 58-59.

Train all staff on relevant information security best practices, because it helps to increase the awareness and understanding of the employees regarding the acceptable use policy and its purpose, and to improve their skills and knowledge on how to protect and handle confidential information. An acceptable use policy is a document that outlines the standards and expectations for the proper usage of the organization’s IT resources, such as systems, applications, networks, or devices, and the consequences of non-compliance. Confidential information is information that is sensitive or proprietary, and may cause harm or damage to the organizationor its stakeholders if disclosed or compromised, such as trade secrets, customer data, or financial records. Training all staff on relevant information security best practices is the best way to reinforce the effectiveness of the policy, as it helps to ensure that the employees are aware of and comply with the policy, and that they adopt the appropriate behaviors and techniques to prevent or mitigate the risk of disclosing confidential information.

Communicating sanctions for policy violations to all staff, obtaining signed acceptance of the new policy from employees, and implementing data loss prevention (DLP) within the corporate network are all possible ways to reinforce the effectiveness of the policy, but they are not the best way, as they do not directly address the awareness and understanding of the employees regarding the policy and its purpose, and they may not be sufficient or effective to prevent or mitigate the risk of disclosing confidential information.

 The primary accountability for a control owner is to ensure the control operates effectively, as they have the authority and responsibility to design, implement, monitor, and report on the performance and adequacy of the control, and to identify and address any control gaps or deficiencies. Communicating risk to senior management, owning the associated risk the control is mitigating, and identifying and assessing control weaknesses are not the primaryaccountabilities, as they are more related to the roles and responsibilities of the risk owner, the risk practitioner, or the auditor, respectively, rather than the control owner. References = CRISC Review Manual, 7th Edition, page 101.

A risk awareness program is a set of activities that aim to educate and inform employees about the organization’s risk culture, policies, and procedures. A risk awareness program can help improve an organization’s risk culture by enhancing the employees’ understanding of risk, their roles and responsibilities in risk management, and the benefits of risk mitigation. A risk awareness program can also foster a culture of openness, trust, and collaboration among employees, managers, and stakeholders, which can improve the organization’s risk performance and resilience.

Maintaining a documented risk register, rewarding employees for reporting security incidents, and allocating resources for risk remediation are also important aspects of risk management, but they do not directly address the organization’s risk culture, which is the shared values, beliefs, and attitudes that influence how risk is perceived and handled within the organization.

According to the CRISC Review Manual1, controls are the policies, procedures, practices, and organizational structures that are designed and implemented to manage risk. The most important factor when defining controls is to align them with the business objectives, as this helps to ensure that the controls support the achievement of the organization’s strategy, goals, and values. Aligning controls with business objectives also helps to optimize the benefits and costs of controls, and to prioritize and allocate resources for control implementation and maintenance. References = CRISC Review Manual1, page 202.

IT control status reporting is the process of collecting and analyzing data about the effectiveness and efficiency of IT controls. IT controls are the policies, procedures, and practices that ensure the confidentiality, integrity, and availability of IT resources and information. IT control status reporting helps to monitor the performance of IT controls against the predefined objectives and criteria, and to identify any gaps or issues that need to be addressed. IT control status reporting also provides information to the stakeholders about the current status and progress of IT control implementation and improvement.

The primary purpose of IT control status reporting is to facilitate the comparison of the current and desired states of IT controls. This means that IT control status reporting helps to evaluate the gap between the actual and expected performance of IT controls, and to determine the actions and resources needed to close the gap. IT control status reporting also helps to align the IT controls with the business goals and strategies, and to ensure that the IT controls are delivering value to the organization. By comparing the current and desired states of IT controls, IT control status reporting enables continuous improvement and optimization of IT control processes and outcomes.

The other options are not the primary purpose of IT control status reporting, but rather some of the benefits or outcomes of it. IT control status reporting can help to ensure compliance with IT governance strategy,but it is not the main reason for doing it. IT governance is the framework that defines the roles, responsibilities, and relationships among the stakeholders involved in ITdecision making and oversight. IT control status reporting can support IT governance by providing relevant and reliable information to the stakeholders, and by demonstrating the accountability and transparency of IT control activities. However, IT control status reporting is not the same as IT governance, and it is not the only way to ensure compliance with IT governance strategy.

IT control status reporting can also assist internal audit in evaluating and initiating remediation efforts, but it is not the main objective of it. Internal audit is an independent and objective assurance and consulting activity that evaluates the adequacy and effectiveness of IT controls, and provides recommendations for improvement. IT control status reporting can provide input and evidence to the internal audit process, and help to identify the areas of IT control that need further review or testing. IT control status reporting can also help to monitor and track the implementation of the audit findings and recommendations, and to verify the results of the remediation efforts. However, IT control status reporting is not the same as internal audit, and it is not the only source of information for internal audit.

Finally, IT control status reporting can benchmark IT controls with industry standards, but it is not the main goal of it. Industry standards are the best practices or guidelines that define the minimum requirements or expectations for IT control performance and quality. IT control status reporting can help to compare the IT controls with the industry standards, and to identify the areas of IT control that need to be enhanced or updated. IT control status reporting can also help to demonstrate the compliance or conformance of IT controls with the industry standards, and to provide assurance to the external parties or regulators. However, IT control status reporting is not the same as industry standards, and it is not the only way to benchmark IT controls. References =

Service Reporting in ITIL: Process, Objectives and Examples - KnowledgeHut

Anatomy of an effective status report - Project Management Institute

How to Create a Project Status Report [Template & Examples]

Communicating Document Control Progress on a Project

[CRISC Review Manual, 7th Edition]

According to the CRISC Review Manual, the primary objective of providing an aggregated view of IT risk to business management is to enable consistent data on risk to be obtained, because it helps to ensure that the risk information is comparable, reliable, and accurate across the organization. An aggregated view of IT risk is a consolidated and comprehensive representation of the IT risk exposure and impact at the enterprise level, based on the risk identification, analysis, and evaluation processes. Providing an aggregated view of IT risk to business management allows them to understand the overall IT risk profile and performance, and to make informed decisions about the risk management strategies and priorities. The other options are not the primary objective of providing an aggregated view of IT risk, as they are related to other benefits or outcomes of the risk aggregation process. Allowing for proper review of risk tolerance is the objective of establishing the risk context, which defines the scope and boundaries of the risk management activities. Identifying dependencies for reporting risk is the outcome of the risk aggregation process, as it provides a clear and consistent structure and format for the risk communication and reporting. Providing consistent and clear terminology is the objective of developing the risk taxonomy, which is the system of classification and categorization of risks based on common characteristics and attributes. References = CRISC Review Manual, 7th Edition, Chapter 2, Section 2.1.2, page 69.

According to the 1.9 Ownership & Accountability - CRISC, risk ownership is best established by mapping risk to specific business process owners. Details of the risk owner should be documented in the risk register. Results of the risk monitoring should be discussed and communicated with the risk owner as they own the risk and are accountable for maintaining the risk within acceptable levels. To ensure effective risk ownership, it is most important that risk owners have decision-making authority, as this enables them totake timely and appropriate actions to manage the risk and ensure that it is aligned with the organization’s risk appetite and tolerance. Without decision-making authority, risk owners may not be able to implement the necessary risk responses or escalate the issues to the relevant stakeholders. Therefore, the answer is D. risk owners have decision-making authority. References = 1.9 Ownership & Accountability - CRISC, The Importance of Effective Risk Governance in the C-suite - Aon

According to the CRISC Review Manual (Digital Version), the primary goal of a risk awareness program is to reduce the risk to an acceptable level by increasing the knowledge and understanding of the risk among the stakeholders. A risk awareness program should:

Educate the stakeholders about the sources, types and impacts of IT-related risks

Explain the roles and responsibilities of the stakeholders in the risk management process

Promote a risk-aware culture that supports the risk appetite and risk tolerance of the organization

Provide guidance and tools for identifying, assessing, responding and monitoring IT-related risks

Encourage the reporting and escalation of risk issues and incidents

Reinforce the benefits and value of effective risk management

References = CRISC Review Manual (Digital Version), Chapter 4: IT Risk Monitoring and Reporting, Section 4.2: IT Risk Reporting, pp. 224-2251

 The greatest risk to change control in business application development over the complete life cycle is the introduction of requirements that have not been approved. Requirements are the specifications or expectations of the business users or stakeholders for the application, such as the features, functions, or performance1. Change control is the process of identifying, evaluating, approving, and implementing changes to the application, such as the design, code, or configuration2. By introducing requirements that have not been approved, the organization can face significant risks, such as:

Scope creep, which is the uncontrolled or unauthorized expansion of the project scope, and can result in increased costs, delays, or errors3.

Quality issues, which can affect the reliability, usability, or security of the application, and can lead to defects, failures, or breaches4.

Stakeholder dissatisfaction, which can arise from the mismatch or inconsistency between the delivered application and the expected application, and can cause complaints, disputes, or litigation5.

The other options are not the greatest risk to change control, because:

Emphasis on multiple application testing cycles is not a risk, but rather a benefit or a best practice for change control, as it can help to ensure that the application meets the requirements and standards, and that the changes are effective and efficient.

Lack of an integrated development environment (IDE) tool is a challenge, but not a risk, for change control, as it can affect the productivity, collaboration, or integration of the developers, and can cause difficulties or inefficiencies in the development process. However, it does not directly affect the requirements or the quality of the application, and it can be overcome by using other tools or methods.

Bypassing quality requirements before go-live is a risk, but not the greatest risk, for change control, as it can compromise the quality or performance of the application, and can expose the organization to errors, failures, or breaches. However, it is less likely or frequent than introducing requirements that have not been approved, and it can be detected or prevented by using quality assurance or quality control techniques.

References =

Requirements - CIO Wiki

Change Control - CIO Wiki

Scope Creep - CIO Wiki

Quality - CIO Wiki

Stakeholder Management - CIO Wiki

[Software Testing - CIO Wiki]

[Integrated Development Environment (IDE) - CIO Wiki]

[Quality Requirements - CIO Wiki]

[Software Development Life Cycle - CIO Wiki]

The primary reason an organization should include background checks on roles with elevated access to production as part of its hiring process is to reduce internal threats. Internal threats are the risks that originate from within the organization, such as employees, contractors, or partners. Roles with elevated access to production have the privilege and ability to access, modify, or delete sensitive or critical data and systems. If these roles are assigned to individuals who have malicious intent, criminal records, or conflicts of interest, they may pose a significant threat to the organization’s security, integrity, and availability. By conducting background checks, the organization can verify the identity, credentials, and history of the candidates, and prevent or minimize the possibility of hiring untrustworthy or unsuitable individuals. The other options are not as important as reducing internal threats, as they are related to the outcomes, impacts, or requirements of the roles with elevated access to production, not the reasons for conducting background checks. References = Risk and Information Systems Control Study Manual, Chapter 3: IT Risk Response, Section 3.3: IT Risk Response Implementation, page 145.

Risk appetite is defined as "the amount of risk that an organization is willing to accept in pursuit of its objectives, before action is deemed necessary to reduce the risk."1 It represents a balance between the potential benefits of innovation and the threats that change inevitably brings. Risk appetite reflects the organization’s risk attitude and its willingness to accept risk in specific scenarios, with a governance model in place for risk oversight. Risk appetite helps to guide the organization’s approach to risk and risk management, and to align its risk decisions with its business objectives and context. The other options are not the best descriptions of risk appetite, as they are either too vague (the effective management of risk and internal control environments), too narrow (acceptable variation between risk thresholds and business objectives), or confusing (the acceptable variation relative to the achievement of objectives). References = Risk Appetite vs. Risk Tolerance: What is the Difference?

Whistleblower Program:

Definition: A whistleblower program allows employees to report unethical or illegal activities within the organization anonymously.

Detection of Ethical Violations: Employees are often in the best position to observe unethical behavior. A well-structured whistleblower program encourages them to report such behavior without fear of retaliation.

Anonymity and Protection: Providing anonymity and protection to whistleblowers increases the likelihood that employees will report violations, thus enabling the organization to detect and address ethical issues more effectively.

Comparison with Other Options:

Transaction Log Monitoring: While useful for detecting anomalies and potential fraud, it is not specifically focused on ethical violations and may not capture all types of unethical behavior.

Access Control Attestation: This ensures that users have the correct access permissions but does not directly detect unethical behavior.

Periodic Job Rotation: This can help prevent fraud by reducing the risk of collusion and providing fresh perspectives on processes, but it does not directly detect ethical violations.

Best Practices:

Clear Reporting Channels: Ensure that the whistleblower program has clear and accessible reporting channels.

Training and Awareness: Regularly train employees on the importance of reporting unethical behavior and the protections offered by the whistleblower program.

Follow-up and Action: Ensure that reports are investigated thoroughly and appropriate actions are taken to address verified violations.

Determining the business purpose of the application is the first thing that a risk practitioner should do when a shadow IT application is identified in a business owner’s business impactanalysis (BIA), because it helps to understand the rationale and value of the application, and the potential risks and issues that it may introduce or affect. A shadow IT application is an IT system or application that is used by the business units or employees without the knowledge or approval of the IT department or management. A shadow IT application may offer benefits such as convenience, efficiency, or innovation, but it may also pose risks such as security breaches, data loss, compatibility issues, or regulatory non-compliance. A BIA is a process of analyzing the potential impact of disruption to the critical business functions or processes, and identifying the recovery priorities and requirements. A BIA may reveal the existence of ashadow IT application, as it may be used to support or enable a critical business function or process. Determining the business purpose of the application is the first thing to do, as it helps to evaluate the necessity and suitability of the application, and to plan the appropriate actions to address the shadow IT application. Including the application in the business continuity plan (BCP), segregating the application from the network, and reporting the finding to management are all possible things to do after determining the business purpose of the application, but they are not the first thing to do, as they depend on the results of the evaluation of the application. References = Risk and Information Systems Control Study Manual, Chapter 4, Section 4.2.1, page 143

 The primary consideration when implementing controls for monitoring user activity logs is ensuring that the control is proportional to the risk, because this helps to optimize the balance between the benefits and costs of the control, and to avoid over- or under-controlling the risk. User activity logs are records of the actions or events performed by users on IT systems, networks, or resources, such as accessing, modifying, or transferring data or files. Monitoring user activity logs can help to detect and prevent potential threats, such as unauthorized access, data leakage, or malicious activity, and to support the investigation and remediation of incidents. However, monitoring user activity logs also involves certain costs and challenges, such as collecting, storing, analyzing, and reporting large amounts of log data, ensuring the accuracy, completeness, and timeliness of the log data, protecting the privacy and security of the log data, and complying with the relevant laws and regulations. Therefore, when implementing controls for monitoring user activity logs, the organization should consider the level and impact of the risk that the control is intended to address, and the value and effectiveness of the control in reducing the risk exposure and impact. The organization should also consider the costs and feasibility of implementing and maintaining the control, and the potential negative consequences or side effects of the control, such as performance degradation, user dissatisfaction, or legal liability. By ensuring that the control is proportional to the risk, the organization can achieve the optimal level of risk management, and avoid wasting resources or creating new risks. References = Risk IT Framework, ISACA, 2022, p. 151

An IT risk register is a document that records the identified IT risks, their analysis, and their responses. It is a useful tool for managing and communicating the IT risks throughout the project or the organization. The most important factor for maintaining the effectiveness of an IT risk register is to perform regular reviews and updates to the register, meaning that the riskpractitioner should periodically check and revise the riskregister to reflect the changes in the IT risk environment, the project status, or the organization’s objectives. Performing regular reviews and updates to the register can help to ensure that the risk register is accurate, complete, and current, and that it provides relevant and reliable information for the risk management decision making and actions. Performing regular reviews and updates to the register can also help to identify any new or emerging IT risks, as well as to monitor and report on the IT risk performance and improvement. References = Risk and Information Systems Control Study Manual, Chapter 3, Section 3.2.1, p. 106-107

The most important characteristic of an effective risk management program is that risk ownership is assigned. Risk ownership is the accountability and authority to manage a risk1. Assigning risk ownership means identifying and assigning the person or entity who is responsible for evaluating, treating, monitoring, and reporting on a specific risk2. Assigning risk ownership is essential for ensuring that the risk management program works effectively and efficiently, as it helps to:

Clarify the roles and responsibilities of the different functions or groups involved in risk management and internal control;

Ensure that the risks are managed in accordance with the organization’s objectives, strategies, and risk appetite;

Provide guidance and support to the risk owners in identifying, assessing, and mitigating the risks;

Monitor and evaluate the performance and effectiveness of the risk owners and the risk response actions;

Communicate and report on the risk status and issues to the relevant stakeholders and authorities. The other options are not the most important characteristic of an effective risk managementprogram, as they are either less relevant or less specific than assigning risk ownership. Risk response plans are documented. This option is a consequence or outcome of an effective risk management program, not a characteristic of it. Risk response plans are the actions or measures that are taken to modify the risk, such as reducing, avoiding, transferring, or accepting the risk3. Documenting risk response plans means recording and maintaining the details and outcomes of the risk responseactions, such as the objectives, scope, resources, timelines, performance indicators, and results4. Documenting risk response plans can help to improve the consistency and transparency of the risk management process, as well as to support the monitoring and evaluation of the risk response actions. However, documenting risk response plans is not the most important characteristic of an effective risk management program, as it does not address the accountability and authority for managing the risk. Controls are mapped to key risk scenarios. This option is a specific or narrow example of an effective risk managementprogram, not a general or broad characteristic of it. Controls are the measures or actions that are taken to reduce the likelihood or impact of a risk, or to increase the likelihood or impact of an opportunity5. Mapping controls to key risk scenarios means linking the controls to the specific situations or events that may affect the organization’s objectives, operations, or performance6. Mapping controls to key risk scenarios can help to enhance the design and implementation of the controls, as well as to evaluate the effectiveness and efficiency of the controls in mitigating the risk. However, mapping controls to key risk scenarios is not the most important characteristic of an effective risk management program, as it does not cover the other aspects of risk management, such as risk identification, assessment, treatment, and monitoring. Key risk indicators are defined. This option is a component or element of an effective risk management program, not a characteristic of it. Key risk indicators are the metrics that measure thelevel and trend of a risk that may affect the organization’s objectives, operations, or performance7. Defining key risk indicators means establishing and maintaining the criteria and methods for measuring and reporting on the risk8. Defining key risk indicators can help to enhance the risk identification, assessment, and reporting processes, as well as to support the risk decision making and prioritization. However, defining key risk indicators is not the most important characteristic of an effective risk management program, as it does not indicate the accountability and authority for managing the risk. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 3, Section 3.1.1, Page 85.

A dashboard summarizing key risk indicators (KRIs) is the best way for a risk practitioner to present an annual risk management update to the board because it provides a concise and visual overview of the current risk status, trends, and performance of the organization. KRIs are metrics that measure the likelihood and impact of risks, and help the board monitor and prioritize the most critical risks. A summary of risk response plans, a report with control environment assessment results, and a summary of IT risk scenarios are all useful information, but they are too detailed and technical for the board, who needs a high-level and strategic view of the risk management program. References = Risk and Information Systems Control Study Manual, Chapter 4, Section 4.4.1, page 4-36.

A third-party security assessment report is the most helpful to ensure effective security controls for a cloud service provider, because it provides an independent and objective evaluation of the cloud provider’s security posture, policies, and practices. A third-party security assessment report can help to verify and validate the cloud provider’s compliance with the relevant standards, regulations, and best practices, such as ISO 27001, PCI DSS, NIST, or CSA. A third-party security assessment report can also help to identify and address any gaps, weaknesses, or vulnerabilities in the cloud provider’s security controls, and to provide recommendations and guidance for improvement. A third-party security assessment report can also help to increase the trust and confidence of the cloud customers, and to facilitate the due diligence and risk management processes. The other options are less helpful to ensure effective security controls for a cloud service provider. A control self-assessment is a process that enables the cloud provider to assess its own security controls, using a predefined framework or questionnaire. However, a control self-assessment may not be as reliable or comprehensive as a third-party security assessment report, as it may be biased, incomplete, or inaccurate, and it may not cover all the aspects or dimensions of security. Internal audit reports from the vendor are documents that provide the results and findings of the internal audits conducted by the cloud provider’s ownauditors, to verify and validate the effectiveness and efficiency of the securitycontrols. However, internal audit reports from the vendor may not be as credible or trustworthy as a third-party security assessment report, as they may be influenced by the cloud provider’s interests, objectives, or agenda, and they may not follow the same standards or criteria as the external auditors. Service level agreement monitoring is a process that measures and evaluates the performance and availability of the cloud services, based on the predefined metrics and targets agreed between the cloud provider and the cloud customer. However, service level agreement monitoring may not be sufficient or relevant to ensure effective security controls for a cloud service provider, as it may not address the security aspects or requirements of the cloud services, such as confidentiality, integrity, or accountability, and it may not reflect the actual security risks or incidents that may occur in the cloud environment. References = Cloud Security Controls: Key Elements and 4 Control Frameworks 1

Authentication is a control that verifies the identity of a user or a system that tries to access a computer system or network. Authentication can be based on something the user or system knows (such as a password or a PIN), something the user or system has (such as a token or asmart card), or something the user or system is (such as a fingerprint or a retina scan). Authentication is a crucial control for preventing unauthorized or malicious access to a system or network, as well as for ensuring the accountability and traceability of the actions performed by the user or system. If the authentication control is compromised, it means that the user or system can bypass or break the verification process and gain access to the system or network without being identified or authorized. This can expose the system or network to various threats, such as data theft, data corruption, data leakage, or denial of service. Therefore, the authentication control has most likely been compromised if a system administrator identifies unusual activity indicating an intruder within a firewall. A firewall is a device or a software that monitors and filters the incoming and outgoing network traffic based on predefined rules and policies. A firewall can help to protect the system or network from external or internal attacks by blocking or allowing the traffic based on the source, destination, protocol, or content. However, a firewall cannot prevent an intruder from accessing the system or network if the intruder has already authenticated or impersonated a legitimate user or system. The other options are not the most likely controls to be compromised if a system administrator identifies unusual activity indicating an intruder within a firewall, although they may be affected or related. Data validation is a control that checks the accuracy, completeness, and quality of the data that is entered, processed,or stored by a system or anetwork. Data validation can help to prevent or detect data errors, anomalies, or inconsistencies that may affect the performance, functionality, or reliability of the system or network. However, data validation does not prevent or detect unauthorized or malicious access to the system or network, as it only focuses on the data, not the user or system. Identification is a control that assigns a unique identifier to a user or a system that tries to access a computer system or network. Identification can be based on a username, an email address, a phone number, or a certificate. Identification is a necessary but not sufficient control for preventing unauthorized or malicious access to a system or network, as it only declares who or what the user or system is, but does not prove it. Identification needs to be combined with authentication to verify the identity of the user or system. Data integrity is a control that ensures that the data is accurate, consistent, and complete throughout its lifecycle. Data integrity can be achieved by implementing various controls, such as encryption, hashing, checksum, digital signature, or backup. Data integrity can help to protect the data from unauthorized or accidental modification, deletion, or corruption that may affect the value, meaning, or usability of the data. However, data integrity does not prevent or detect unauthorized or malicious access to the system or network, as it only protects the data, not the user or system. References = CRISC Review Manual, pages 164-1651; CRISC Review Questions, Answers &Explanations Manual, page 952; What is Authentication? - Definition from Techopedia3; What is a Firewall? - Definition from Techopedia4

The most important factor to communicate to senior management during the initial implementation of a risk management program is the desired risk level, which is the level of risk that the organization aims to achieve in order to fulfill its objectives and strategy1. The desired risk level can help to:

Define and communicate the risk appetite and tolerance, which are the amount and type of risk that the organization is willing to accept or pursue in order to achieve its objectives2.

Guide and align the risk identification, analysis, evaluation, and treatment processes, and ensure that the risks are consistent and proportional to the desired risk level3.

Measure and monitor the risk performance and outcome, and ensure that the actual risk level is within the desired risk level, or take corrective actions if needed4.

The other factors are not the most important to communicate to senior management, because:

Regulatory compliance is a necessary but not sufficient factor to communicate to senior management, as it ensures that the risk management program complies with the applicable laws, rules, or standards that govern the organization’s activities and operations5. However, regulatory compliance does not guarantee that the risk management program is relevant and useful for the organization’s specific objectives and strategy.

Risk ownership is a desirable but not essential factor to communicate to senior management, as it assigns the roles and responsibilities for managing the risks and implementing the risk responses to the appropriate individuals or entities within the organization. However, risk ownership does not ensure that the risk management program is effective and efficient in achieving the desired risk level.

Best practices are a useful but not critical factor to communicate to senior management, as they provide the guidelines and standards for designing and implementing the risk management program, based on the experience and knowledge of the industry or the profession. However, best practices do not ensure that the risk management program is suitable and feasible for the organization’s specific context and capabilities.

References =

Desired Risk Level - CIO Wiki

Risk Appetite and Tolerance - CIO Wiki

Risk Management Process - CIO Wiki

Risk Monitoring - CIO Wiki

Regulatory Compliance - CIO Wiki

[Risk Ownership - CIO Wiki]

[Best Practice - CIO Wiki]

[Risk Management - CIO Wiki]

The risk scenario chart shows the initial and residual risk ratings, and the project cost, for four projects named Sierra, Tango, Uniform, and Victor. The initial risk rating is the level of risk before applying any controls or mitigation measures, while the residual risk rating is the level of risk after applying the controls or measures. The project cost is the amount of resources required to implement the project. These three factors can be used to determine the relative positions of the projects on a risk map, which is a graphical tool for displaying the risks based on their impact and likelihood. The risk map can help to prioritize and compare the risks, and to select the most appropriate risk response strategy. The other options are not the best answers, as they are not directly shown or derived from the risk scenario chart. The risk treatment options are the possible actions that can be taken to address the risks, such as accept, avoid, mitigate, or transfer. The capability of enterprise to implement is the ability of the organization to execute the risk response plan,considering the available resources, skills, and constraints. The multiple risk factors addressed by a chosen response are the various elements that contribute to or affect the risk, such as the threat sources, events, vulnerabilities, assets, and impacts. These factors are not explicitly stated or measured in the risk scenario chart, and may require further analysis or information. References = How to Write Strong Risk Scenarios and Statements - ISACA; Identifying the Right Risk Scenarios to Measure with FAIR; How to write good risk scenarios and statements