Certified in Risk and Information Systems Control (CRISC) — Question 382

Which of the following is the PRIMARY reason to adopt key control indicators (KCIs) in the risk monitoring and reporting process?

Answer options

• A. To provide assurance of adherence to risk management policies
• B. To provide measurements on the potential for risk to occur
• C. To provide data for establishing the risk profile
• D. To provide assessments of mitigation effectiveness

Correct answer: D

Explanation

The correct answer, D, highlights that KCIs are primarily used to assess how effective risk mitigation measures are. Options A, B, and C, while relevant to risk management, do not focus specifically on the effectiveness of mitigation, which is the key aspect of KCIs.