Certified in Risk and Information Systems Control (CRISC) — Question 103

Which of the following should be of MOST concern to a risk practitioner reviewing findings from a recent audit of an organization's data center?

Answer options

• A. Ownership of an audit finding has not been assigned
• B. The data center is not fully redundant
• C. Audit findings were not communicated to senior management
• D. Key risk indicators (KRIs) for the data center do not include critical components

Correct answer: A

Explanation

The most concerning issue is that no ownership has been assigned for an audit finding, as this can lead to accountability gaps and unresolved issues. While redundancy, communication with senior management, and the inclusion of critical components in KRIs are important, they are secondary to the need for clear ownership to ensure that findings are addressed responsibly.