Certified in Risk and Information Systems Control (CRISC) — Question 912

Which of the following is BEST determined by analysis of incident reports?

Answer options

• A. Changes in the external risk environment
• B. Effectiveness of internal controls
• C. Ranges for key performance indicators (KPIs)
• D. Thresholds for key risk indicators (KRIs)

Correct answer: B

Explanation

The effectiveness of internal controls can be gauged by analyzing incident reports, as these reports provide insights into how well controls are functioning in mitigating risks. The other options, while important, do not directly derive from incident report analysis; external risk changes, KPIs ranges, and KRI thresholds require different forms of evaluation.