CRISC Certified in Risk and Information Systems ControlRisk Response and ReportingMedium
A financial services organization has identified a high risk of unauthorized access to its critical customer database. To address this, they implement multi-factor authentication (MFA) for all database administrators, regular security awareness training, and an intrusion detection system (IDS) to alert on suspicious activities. During a recent review, the risk practitioner notes that the IDS frequently generates alerts, but these alerts are often ignored or dismissed without proper investigation due to their high volume and lack of context. Which of the following is the MOST significant implication of this situation?
- AThe control monitoring process is ineffective.
- BThe initial risk assessment was flawed.
- CThe control documentation is incomplete.
- DThe risk appetite has been exceeded.
Show answer & explanationAnswer & explanation
Correct answer: A. The control monitoring process is ineffective.
The IDS is generating alerts (a form of monitoring output), but the subsequent handling of these alerts (ignoring or dismissing them) indicates a breakdown in the process of acting upon information gathered by the control. This points to an ineffective control monitoring process, as the monitoring is not leading to appropriate response or action.
Why the other options are wrong
- B. While a flawed risk assessment could exist, the immediate problem is the failure to respond to the output of an existing control, implying a monitoring breakdown.
- C. Incomplete control documentation might contribute to the issue but is not the direct cause of alerts being ignored.
- D. Exceeding risk appetite relates to the overall level of risk, not specifically the failure to act on control outputs.
Control Monitoring Effectiveness
Control monitoring effectiveness assesses how well the processes in place detect control failures, deviations, or risk events, and ensure that appropriate actions are taken based on the monitoring results.
- Focuses on the ongoing review and analysis of control performance.
- Includes processes for identifying and addressing control deficiencies.
- Crucial for ensuring controls remain effective over time.
Memory trick: Monitor and React: Don't just watch, act!