CRISC Control Design and Effectiveness

1. Which of the following is a characteristic of an effective control?

Achieves its control objective consistently

Requires minimal documentation

Applies to all organizational risks equally

Eliminates the need for risk assessment

Submit

3. True or False: Control design should be completed before any risk assessment is performed.

True

False

4. Which of the following best represents a gap in control design?

A risk identified but not addressed by existing controls

Excessive number of controls

Overly complex control documentation

Controls that are too simple

Submit

6. In CRISC, what is the significance of control interdependencies?

They indicate controls are redundant and unnecessary

They show how controls work together to manage related risks

They suggest controls should be eliminated

They are irrelevant to control design

Submit

8. Which of the following is a key component of control design documentation?

Control objective, scope, and responsibility assignment

Only cost estimates

Risk register without control mapping

Annual audit schedules

9. What is the relationship between risk appetite and control design?

Risk appetite determines the intensity and type of controls needed

Controls are independent of risk appetite

Risk appetite only applies to compliance controls

Controls eliminate the need for risk appetite definition

Submit

11. Which phase of the control lifecycle focuses on establishing control objectives and designing control mechanisms?

Planning and design

Implementation

Monitoring and evaluation

Risk assessment only

12. In the context of CRISC, what does 'control maturity' refer to?

The age of control documentation

The degree of control sophistication and reliability

The budget allocated to control implementation

The number of people managing controls

Submit

14. Which metric is most appropriate for measuring control effectiveness over time?

Number of control objectives defined

Percentage of control tests passed

Total control implementation cost

Count of risk assessments performed

15. What is the key difference between control design and control effectiveness?

Design creates the control; effectiveness measures how well it works

Effectiveness occurs before design in the risk cycle

Design and effectiveness are identical concepts

Effectiveness only applies to detective controls

16. Which framework provides a structured approach to IT risk management and aligns with CRISC principles?

COBIT

ISO 31000

NIST Cybersecurity Framework

All of the above

Submit

18. In control effectiveness assessment, what does RACI stand for?

Risk Assessment Control Implementation

Responsible, Accountable, Consulted, Informed

Risk Analysis Control Integration

Remediation and Compliance Initiative

19. Which of the following best describes a preventive control?

Identifies unauthorized access attempts after they occur

Stops unauthorized actions before they happen

Repairs damage caused by security incidents

Documents all control failures for review

20. What is the primary purpose of a control in IT risk management?

To eliminate all organizational risk

To reduce risk to an acceptable level

To transfer risk to external parties

To document all business processes

CRISC Control Design and Effectiveness Quiz

1. Which of the following is a characteristic of an effective control?

2.

What first name or nickname would you like us to use?

2. The control environment refers to ____.

3. True or False: Control design should be completed before any risk assessment is performed.

4. Which of the following best represents a gap in control design?

5. Control effectiveness evaluation should occur ____.

6. In CRISC, what is the significance of control interdependencies?

7. An automated control differs from a manual control primarily in that it ____.

8. Which of the following is a key component of control design documentation?

9. What is the relationship between risk appetite and control design?

10. Control testing should be performed to ____.

11. Which phase of the control lifecycle focuses on establishing control objectives and designing control mechanisms?

12. In the context of CRISC, what does 'control maturity' refer to?

13. A compensating control is used when ____.

14. Which metric is most appropriate for measuring control effectiveness over time?

15. What is the key difference between control design and control effectiveness?

16. Which framework provides a structured approach to IT risk management and aligns with CRISC principles?

17. A detective control is best described as one that ____.

18. In control effectiveness assessment, what does RACI stand for?

19. Which of the following best describes a preventive control?

20. What is the primary purpose of a control in IT risk management?