Explanation/Reference:
Explanation:
The controls within the schedule management plan can shape how quantitative risk analysis will be performed on the schedule.
Schedule management plan also describes how the schedule contingencies will be reported and assessed.
Incorrect Answers:
A: When risks are likely to happen is important, but it is not the best answer for this question C: This is not a valid answer for this question throughout the project, but it is not scheduled during the quantitative risk analysis process.
D: Risks may affect the project schedule, but this is not the best answer for the question.

Enforcing segregation of duties between the vendor master file and invoicing is the best process control to mitigate the risk of an employee issuing fraudulent payments to a vendor. This is because segregation of duties is a key internal control that prevents or detects errors, fraud, or abuse by ensuring that no single person can perform incompatible or conflicting tasks. The vendor master file is a database that contains the information and settings for each vendor, such as name, address, bank account, payment terms, etc. Invoicing is the process of generating and sending bills to the vendors for the goods or services they provide. If the same person can access and modify the vendor master file and issue invoices, he or she could create fictitious vendors, alter vendor information, or generate false or duplicate invoices, and then divert the payments to his or her own account. By segregating these duties, the organization can reduce the opportunity and likelihood of such fraudulent activities. According to the CRISC Review Manual 2022, segregation of duties is one of the key IT control objectives and practices1. According to the web search results, segregation of duties between the vendor master file and invoicing is a common and recommended control to prevent vendor fraud

Section: Volume D

Explanation/Reference:
Explanation:
Senior management is responsible for the acceptance and mitigation of all risk. Hence they will also own the risk to an information system that supports a critical business process.
Incorrect Answers:
A: The system users are responsible for utilizing the system properly and following procedures, but they do not own the risk.
C: The IT director manages the IT systems on behalf of the business owners.
D: The risk management department determines and reports on level of risk, but does not own the risk.
Risk is owned by senior management.