Skip to main content

4.6 Result of Control Assessment


4.6 Result of Control Assessment

4.6 Result of Control Assessment


Effectiveness of the control monitoring program depends on following parameters:


  • Accuracy of the data on the basis of which controls are evaluated


  • Timely reporting on risk to management for taking corrective action


  • Skill set of risk practitioner to properly evaluate the controls


Maturity Model Assessment and Improvement Techniques


  • Risk management program should be a dynamic process and should evolve and improve on a continuous basis.


  • Risk management programs should be improved on the basis of learnings from past events.


  • Adoption of a capability maturity model (CMM) helps to indicate the maturity of the risk management process year over year.


  • CMM helps an organization to understand its level of maturity by analyzing the operational effectiveness, efficiency and readiness. It provides insight into an organization's risk management capabilities.


  • Maturity can be determined by analyzing the risk aware culture of the organization. Employees of a matured organization are aware about the risk of their processes and willing to resolve the same.


  • With the help of the maturity model, the level of competence of the organization can be benchmarked and compared with the peers.


  • Objective of adopting a maturity model is to strive for continuous improvement. This can be done by assessing the current maturity level of the business process and comparing the same with desired level. Gaps, if any, needs to be addressed to improve the process and maturity level.




Key aspects from CRISC exam perspective


CRISC Questions 

Possible Answer 

What kind of  model provides insight into organization's risk management capabilities?

Capacity maturity model (CMM)


Maturity of an organization’s risk management policy can be determined by

Risk culture and awareness of the organization

Organization can measure its risk management process against its peer by

Adoption of maturity model

Best reason to implement a maturity model

To enable continuous improvement


Best approach to determine whether existing security control is in accordance with desired level

To conduct maturity assessment/Gap Assessment 



Self-Assessment Questions


Flashcards - 4.6 Result of Control Assessment


Practice Questions - 4.6 Result of Control Assessment


Popular posts from this blog

2.7 Risk Analysis Methodologies

2.7 Risk Analysis Methodologies Risk analysis is the process of ranking of various risk so that areas of high can be prioritized for treating them.   Risk can be measured and ranked by use of any of the following methods:   Quantitative Risk Assessment Qualitative Risk Assessment Semi-quantitative Risk Assessment   Factor that influence the selection for above technique is availability of accurate data for risk assessment. When data source is accurate and reliable, organization will prefer quantitative risk assessment as it will give risk value in some numeric terms like monitory values. Monetary value is easy to evaluate to determine the risk response. Quantitative Risk Assessment In quantitative risk assessment, risk is measured on the basis on numerical values. This helps in cost benefit analysis as risk in monetary term can be easily compared to cost of various risk responses.   In quantitative risk assessment, various statist...
Read more

30% Discount - CRISC Recorded Lecture

We are pleased to announce that we are offering CRISC recorded lectures at 30% discount. Please use below link to avail the discount https://www.udemy.com/course/crisc-with-hemang-doshi/?couponCode=CRISCMARCH21037
Read more

2.5 Project & Program Management

2.5 Project & Program Management ·          It is very important for a risk practitioner to monitor the risk related to the management of the projects.   ·          Some of major reason for failing of IT projects are:   §   Scope creep i.e. requirements are not properly defined at the initial phase. §   Lack planning resulting into over budget and unavailability of skilled resources. §   Lack of structured project management process. §   Systems not tested before implementation §   Compliance or regulatory issues   ·          Root cause for the system failure is to be determined so the learnings can be applied to all the future projects.   ·          Major cause for a project failure is delay in completion. It may happen to make for the time lapsed...
Read more