CRISC - Risk Response and Reporting - Section 3.9

Monitor risk and controls through data collection, aggregation and analysis, and manage issues, findings and exceptions.

Monitor risk and controls through continuous data collection, aggregation, and analysis to detect changes in the risk environment or control performance. Manage issues, findings, and exceptions through a structured process that tracks each item to resolution and escalates those that breach defined thresholds.

Risk monitoringControl monitoringIssue managementException management

Practice question for this objective

Free sampleRisk Response and Reportingmedium

A new automated control will replace a manual authorisation step in a high-volume order pipeline at go-live. The risk practitioner wants the implementation itself to avoid halting order processing if the new control behaves unexpectedly on the first day. Which implementation arrangement best manages this go-live risk?

  • ARun the new control in parallel with the retained manual step and keep a tested rollback path until it is confirmed stable Correct
  • BSwitch the entire pipeline to the new automated control overnight so that all orders are covered by it from the first business day
  • CDefer the new control until the manual step has been fully decommissioned and the responsible staff have been reassigned elsewhere
  • DEnable the new control only for the largest customers first because their orders justify the closest monitoring during go-live
Manage control go-live risk by running the new control in parallel with the old one and keeping a tested rollback until stability is confirmed. Implementing a control is itself a source of risk, because a newly deployed control can behave unexpectedly in production. Running the new automated control in parallel with the retained manual step, backed by a tested rollback path, means order processing continues even if the new control fails on its first day. The parallel period is ended only once monitoring confirms the control is stable, which contains implementation disruption without leaving the objective unprotected.

Why A is correct: Running the new control alongside the existing one with a tested rollback lets processing continue if the new control fails, which is the safest way to manage go-live disruption risk.

Why B is wrong: A clean overnight cutover is simplest to coordinate, but it leaves no fallback if the new control misbehaves, so a first-day fault could halt the whole order pipeline.

Why C is wrong: Removing the manual step first feels tidy, but it destroys the very fallback that would protect processing during the risky early period of the new control.

Why D is wrong: Targeting the biggest customers concentrates rather than reduces exposure, since any first-day fault would then strike the most important orders without a fallback in place.

See more CRISC practice questions, answers explained.

More in this domain

Back to all Risk Response and Reporting objectives, or the CRISC cert hub.

Examworthy is not affiliated with or endorsed by ISACA. Original, blueprint-aligned practice material only.