Certified in Risk and Information Systems Control (CRISC) — Question 1222

For which of the following risk management capability maturity levels do the statement given below is true? "Real-time monitoring of risk events and control exceptions exists, as does automation of policy management"

Answer options

• A. Level 3
• B. Level 0
• C. Level 5
• D. Level 2

Correct answer: C

Explanation

The correct answer is Level 5 because at this maturity stage, organizations have advanced capabilities, including real-time monitoring and automated processes for managing risks and policies. Level 0 indicates no capability, while Levels 2 and 3 do not fully encompass the automation and real-time monitoring described in the statement.