Explanation: An insurance policy can compensate the enterprise up to 100% by transferring the risk to another company. Hence in this stem risk is being transferred.
Incorrect Answers:
A: Updating the risk registry (with lower values for impact and probability) will not actually change the risk, only management’s perception of it.
C: Outsourcing the process containing the risk does not necessarily remove or change the risk. While on other hand, insurance will completely remove the risk.
D: Staff capacity to detect or mitigate the risk may potentially reduce the financial impact, but insurance allows for the risk to be mitigated up to 100%.

Explanation: Because this change deals with the change of the deliverable, it should pass through the cost change control system. The cost change control system reviews the reason why the change has happened, what the cost affects, and how the project should respond.
Incorrect Answers:
B: This is not a contract change. According to the evidence that a contract exists or that the cost of the materials is outside of the terms of a contract if one existed. Considered a time and materials contract, where a change of this nature could be acceptable according to the terms of the contract. If the vendor wanted to change the terms of the contract then it would be appropriate to enter the change into the contract change control system.
C: The scope of the project will not change due to the cost of the materials.
D: There are four change control systems that should always be entertained for change: schedule, cost, scope, and contract.

Explanation: Direct extraction from the source system involves management monitoring its own controls, instead of auditors/third parties monitoring management’s controls. It is preferable over extraction from the system custodian.
Incorrect Answers:
B: Extracting data from the system custodian (IT) after system owner approval, involves auditors or third parties monitoring management’s controls. Here, in this management does not monitors its own control. C, D: These are not data extraction methods.

Explanation: They are monitored on regular basis as they indicate high probability and high impact risks. As risks change over time, hence KRIs should also be monitored regularly for its effectiveness on these changing risks.
Incorrect Answers:
A, B, C: These all are true for KRIs. Key Risk Indicators are the prime monitoring indicators of the enterprise. KRIs are highly relevant and possess a high probability of predicting or indicating important risk. KRIs help in avoiding excessively large number of risk indicators to manage and report that a large enterprise may have. The complete set of KRIs should also balance indicators for risk, root causes and business impact, so as to indicate the risk and its impact completely.

Explanation:
Loss of integrity refers to the following types of losses:

• An e-mail message is modified in transit
• A virus infects a file
• Someone makes unauthorized changes to a Web site

Incorrect Answers:
A: Someone sees a password or a company’s secret formula, this is referred to as loss of confidentiality.
C: An e-mail server is down and no one has e-mail access, or a file server is down so data files aren’t available comes under loss of availability.
D: This refers to the events which would eventually cause loss of revenue.

Explanation:
A risk analysis deals with the potential size and likelihood of loss. A risk analysis involves identifying the most probable threats to an organization and analyzing the related vulnerabilities of the organization to these threats. A risk from an organizational perspective consists of:

• Threats to various processes of organization.
• Threats to physical and information assets.
• Likelihood and frequency of occurrence from threat.
• Impact on assets from threat and vulnerability.
• Risk analysis allows the auditor to do the following tasks :
• Identify threats and vulnerabilities to the enterprise and its information system.
• Provide information for evaluation of controls in audit planning.
• Aids in determining audit objectives.
• Supporting decision based on risks.

Incorrect Answers:
A: Assuming equal degree of protection would only be rational in the rare event that all the assets are similar in sensitivity and criticality. Hence this is not practiced in risk analysis.
B: Since the likelihood determines the size of the loss, hence both elements must be considered in the calculation.
C: A risk analysis would not normally consider the benchmark of similar companies as providing relevant information other than for comparison purposes.

Explanation:
Business alignment require following control activities:

• Defining the business requirements for the management of data by IT.
• Periodically identifying critical data that affect business operations, in alignment with the risk management model and IT service as well as the business continuity plan.

Incorrect Answers:
B: Conducting IT continuity tests on a regular basis or when there are major changes in the IT infrastructure is done for testing IT continuity plan. It does not ensure alignment with business.
D: This is not a valid answer.

Explanation:
The configuration management system ensures that proposed changes to the project’s scope are reviewed and evaluated for their affect on the project’s product.
Configure management process is important in achieving business objectives. Ensuring the integrity of hardware and software configurations requires the establishment and maintenance of an accurate and complete configuration repository. This process includes collecting initial configuration information, establishing baselines, verifying and auditing configuration information, and updating the configuration repository as needed. Effective configuration management facilitates greater system availability minimizes production issues and resolves issues more quickly.
Incorrect Answers:
A: The cost change control system is responsible for reviewing and controlling changes to the project costs.
C: The scope change control system focuses on reviewing the actual changes to the project scope. When a change to the project’s scope is proposed, the configuration management system is also invoked.
D: Integrated change control examines the affect of a proposed change on the project as a whole.

Explanation:
A risk analysis involves identifying the most probable threats to an organization and analyzing the related vulnerabilities of the organization to these threats. A risk from an organizational perspective consists of:

• Threats to various processes of organization.
• Threats to physical and information assets.
• Likelihood and frequency of occurrence from threat.
• Impact on assets from threat and vulnerability.
• Risk analysis allows the auditor to do the following tasks :
• Threats to various processes of organization.
• Threats to physical and information assets.
• Likelihood and frequency of occurrence from threat.
• Impact on assets from threat and vulnerability.
• Risk analysis allows the auditor to do the following tasks :
• Identify threats and vulnerabilities to the enterprise and its information system.
• Provide information for evaluation of controls in audit planning.
• Aids in determining audit objectives.
• Supporting decision based on risks.

Incorrect Answers:
B: Auditors identify threats and vulnerability not only in the IT but the whole enterprise as well.