Certified in Risk and Information Systems Control (CRISC) — Question 461

When reporting on the performance of an organization's control environment, including which of the following would BEST inform stakeholders' risk decision- making?

Answer options

• A. A report of deficiencies noted during controls testing
• B. Spend to date on mitigating control implementation
• C. A status report of control deployment
• D. The audit plan for the upcoming period

Correct answer: A

Explanation

A report detailing deficiencies identified during controls testing is crucial as it highlights vulnerabilities that could impact risk decisions. In contrast, spending on control implementation (B) and status reports on deployment (C) do not directly address the effectiveness of controls, while the audit plan (D) focuses on future activities rather than current performance.