CRISC Certified in Risk and Information Systems ControlRisk Response and ReportingHard
A financial services organization is implementing a new customer relationship management (CRM) system. To ensure data integrity, the control design includes automated reconciliation checks between the CRM and the core banking system at the end of each business day. Additionally, a manual review of reconciliation exceptions is performed by a data analyst. Which principle of control design is BEST exemplified by the combination of these automated and manual reconciliation processes?
- ACost-effectiveness
- BLayered defense (Defense in Depth)
- CProportionality
- DTimeliness
Show answer & explanationAnswer & explanation
Correct answer: B. Layered defense (Defense in Depth)
The combination of automated reconciliation checks and a manual review of exceptions exemplifies the principle of layered defense, also known as defense in depth. This principle advocates for using multiple, independent controls to protect against a single risk. If one control (automated check) fails or misses something, another control (manual review) acts as a backup or secondary layer of protection, increasing the overall effectiveness and resilience against data integrity issues.
Why the other options are wrong
- A. While important, cost-effectiveness is not the primary principle exemplified by combining automated and manual controls for redundancy.
- C. Proportionality means controls should be commensurate with the risk level, which is a design consideration but not directly exemplified by the combination of control types.
- D. Timeliness refers to controls operating quickly, which is less about the combination of control types and more about their execution speed.
Defense in Depth
A strategy that employs multiple layers of security controls to protect against a single point of failure.
- Uses a combination of administrative, technical, and physical controls.
- Aims to slow down an attacker or prevent a breach if one layer fails.
- Enhances overall resilience and robustness of security posture.
Memory trick: Design Controls Diligently for Defense.