Section: Volume C
Explanation:
As new threats are identified and prioritized in terms of impact, the first step is to evaluate the ability of existing controls to mitigate risk associated with new threats and if it does not work then in that case facilitate the:
* Modification of the technical architecture
* Deployment of a threat-specific countermeasure
* Implementation of a compensating mechanism or process until mitigating controls are developed
* Education of staff or business partners
Incorrect Answers:
D: Applying more controls is not the good solution. They usually complicate the condition.

The primary reason for periodically monitoring key risk indicators (KRIs) is to detect changes in the risk profile of the enterprise. KRIs are metrics that provide information on the level of exposure to a specific risk or a group of risks. By monitoring KRIs, the enterprise can identify any deviations from the expected risk level, and take appropriate actions to adjust the risk response or the risk appetite. Monitoring KRIs also helps to validate the effectiveness of risk mitigation controls and the accuracy of risk assessments. Rectifying errors in results of KRIs, reducing costs of risk mitigation controls, and continually improving risk assessments are possible benefits of monitoring KRIs, but they are not the primary reason. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 4, Section 4.1.1.2, page 175.

* A risk dashboard is a graphical tool that displays the key indicators and metrics of the organization's IT risk profile, such as the risk level, status, trend, performance, etc., using charts, graphs, tables, etc. A risk dashboard can help the organization to monitor and communicate the IT risk profile, and to support the decision making and planning for the IT risk management.
* A risk dashboard is the most effective tool in identifying trends in the IT risk profile, because it provides a visual and intuitive representation of the changes and variations in the IT risk profile over time, and highlights the most significant and relevant IT risks that need to be addressed or monitored. A risk dashboard can also help to compare and contrast the IT risk profile with the organization's IT objectives and risk appetite, and to identify the gaps or opportunities for improvement.
* The other options are not the most effective tools in identifying trends in the IT risk profile, because they do not provide the same level of visibility and clarity that a risk dashboard provides, and they may not be updated or aligned with the organization's IT objectives and risk appetite.
* A risk self-assessment is a process of identifying, analyzing, and evaluating the IT risks that may affect the organization's objectives and operations, using the input and feedback from the individuals or groups that are involved or responsible for the IT activities or functions. A risk self-assessment can help the organization to understand and document the IT risk profile, and to align it with the organization's IT strategy and culture, but it is not the most effective tool in identifying trends in the IT risk profile, because it may not reflect the current or accurate state and performance of the IT risk profile, and it may not cover all the relevant or emerging IT risks that may exist or arise.
* A risk register is a document that records and tracks the information and status of the identified IT risks and their responses. It includes the IT risk description, category, source, cause, impact, probability, priority, response, owner, action plan, status, etc. A risk register can help the organization to identify, analyze, evaluate, and communicate the IT risks and their responses, and to align them with the organization's IT strategy and culture, but it is not the most effective tool in identifying trends in the IT risk profile, because it may not provide a visual and intuitive representation of the changes and variations in the IT risk profile over time, and it may not highlight the most significant and relevant IT risks that need to be addressed or monitored.
* A risk map is a graphical tool that displays the results of the IT risk analysis in a matrix format, using colors and symbols to indicate the level and priority of the IT risks. A risk map can show the distribution and comparison of the IT risks based on various criteria, such as likelihood, impact, category, source, etc. A risk map can help the organization to assess and prioritize the IT risks, and to design and implement appropriate controls or countermeasures to mitigate or prevent the IT risks, but it is not the most effective tool in identifying trends in the IT risk profile, because it may not provide a visual and intuitive representation of the changes and variations in the IT risk profile over time, and it may not reflect the organization's IT objectives and risk appetite.
References =
* ISACA, CRISC Review Manual, 7th Edition, 2022, pp. 19-20, 23-24, 27-28, 31-32, 40-41, 47-48,
54-55, 58-59, 62-63
* ISACA, CRISC Review Questions, Answers & Explanations Database, 2022, QID 180
* CRISC Practice Quiz and Exam Prep