Certified in Risk and Information Systems Control (CRISC) — Question 256

In which of the following conditions business units tend to point the finger at IT when projects are not delivered on time?

Answer options

• A. Threat identification in project
• B. System failure
• C. Misalignment between real risk appetite and translation into policies
• D. Existence of a blame culture

Correct answer: D

Explanation

The correct answer is D, as a blame culture fosters an environment where business units are quick to attribute project delays to IT. In contrast, options A, B, and C refer to specific issues or failures that may occur but do not inherently create a culture of blame.