Explanation/Reference:
Explanation:
This is an example of a preventive control as the problem is not yet occurred, only it is detected and are accounted for. By removing the scope items from the project work, the project manager is aiming to remove the added risk events, hence it is a preventive control. Preventive control is a type of internal control that is used to avoid undesirable events, errors and other occurrences, which an organization has determined could have a negative material effect on a process or end product.
Incorrect Answers:
A: Detective controls simply detect and report on the occurrence of problems. They identify specific symptoms to potential problems.
C: Corrective actions are steps to bring the future performance of the project work in line with the project management plan. These controls make effort to reduce the impact of a threat from problems discovered by detective controls. They first identify the cause of the problems, then take corrective measures and modify the systems to minimize the future occurrences of the problem. Hence an incident should take place before corrective controls come in action.
D: Scope creep refers to small undocumented changes to the project scope.

IT asset inventory is the process of tracking and managing the financial, physical, licensing, and contractual aspects of IT assets throughout their life cycle1. IT assets include hardware, software, and network components that an organization values and uses to achieve its objectives2. A complete and accurate IT asset inventory can help an organization to optimize its IT budget, reduce security risks, ensure compliance, and improve performance3.
One of the best controls to enable an organization to ensure a complete and accurate IT asset inventory is performing network scanning for unknown devices. Network scanning is the process of identifying and collecting information about the devices connected to a network, such as their IP addresses, operating systems, open ports, services, and vulnerabilities4. Network scanning can help an organization to:
* Discover and inventory all the IT assets on the network, including those that are unauthorized,
* unmanaged, or hidden
* Detect and remove any rogue or malicious devices that may pose a threat to the network security or performance
* Update and verify the asset inventory data regularly and automatically, and alert on any changes or discrepancies
* Support the asset lifecycle management and maintenance activities, such as patching, upgrading, or retiring assets5 References = IT Asset Valuation, Risk Assessment and Control Implementation Model, ITAM: The ultimate guide to IT asset management, Navigating Security Threats with IT Inventory Management, Network Scanning - Wikipedia, 8 Best IT Asset Management Software (2024)

* Business Impact Analysis (BIA):
* Purpose: A BIA is a systematic process to evaluate the potential effects of an interruption to critical business operations as a result of a disaster, accident, or emergency.
* Identification of Consequences: It identifies critical resources and the consequences of their loss, allowing an organization to determine the operational and financial impacts of such losses.
* Steps Involved in BIA:
* Identify Critical Functions: Determine which business functions and processes are essential to the organization's operations.
* Assess Impact: Evaluate the impact of losing these functions on the organization's ability to operate.
* Estimate Downtime Tolerance: Determine the maximum allowable downtime for critical functions before significant harm occurs.
* Identify Dependencies: Document dependencies between systems, processes, and resources to understand how disruptions to one part affect the whole.
* Comparison with Other Options:
* Risk Management Action Plans: These are detailed plans developed to address identified risks but do not specifically focus on the impact of losing critical resources.
* What-if Technique: This is a brainstorming technique used to explore potential risks and their impacts but is not as structured as a BIA.
* Tabletop Exercise Results: These exercises simulate disaster scenarios to test response plans but do not provide the comprehensive impact analysis that a BIA does.
* Best Practices:
* Regular Updates: Regularly update the BIA to reflect changes in the business environment and operational dependencies.
* Integration with DR/BC Plans: Ensure that findings from the BIA are integrated into disaster recovery (DR) and business continuity (BC) plans to enhance overall preparedness.
* CRISC Review Manual: Discusses the importance of BIA in identifying the impacts of losing critical resources and guiding the development of effective risk management strategies.
* ISACA Standards: Highlight the role of BIA in evaluating the consequences of resource loss and informing business continuity planning.
References:

is incorrect. Communicate the negative impacts of events that drive response decisions as well as positive impacts of events that represent opportunities which should channel back into the strategy and objective setting process, for effective communication. Only negative impacts are not considered alone.