Testing is completed by IT support users without input from end users should be of most concern to a risk practitioner reviewing the system development life cycle (SDLC). This is because testing without input from end users can result in poor quality, usability, and functionality of the system, as well as increased errors, defects, and rework. Testing without input from end users can also lead to user dissatisfaction, resistance, and non-compliance, as well as misalignment with the business requirements and objectives. According to the CRISC Review Manual 2022, one of the key risk identification techniques for IT projects is to involve the end users and other relevant parties in the testing process1. According to the CRISC Review Questions, Answers
& Explanations Manual 2022, testing without input from end users is the correct answer to this question2.
Testing in phases, overriding segregation of duties controls, and using data anonymization are not the most concerning issues for a risk practitioner reviewing the SDLC. These are possible practices or techniques that can be used in the testing process, but they do not necessarily pose significant risks or problems. Testing in phases can help ensure that the system meets the technical and functional specifications, as well as the user acceptance criteria, at each stage of the development. Overriding segregation of duties controls can be justified and authorized during the testing phases, as long as the controls are restored and verified before the system goes live. Using data anonymization can help protect the privacy and security of the data used in the testing process, as well as comply with the relevant regulations and standards.

The greatest risk associated with the transition of a sensitive data backup solution from on-premise to a cloud service provider is inadequate data encryption. Data encryption is a key security measure that protects the confidentiality and integrity of data, especially when it is stored or transmitted over a network. If the data encryption is inadequate, the data backup solution may be vulnerable to unauthorized access, modification, or disclosure by malicious actors or third parties. This could result in data breaches, regulatory fines, reputational damage, or legal liabilities for the enterprise. More complex test restores, inadequate service level agreement (SLA) with the provider, and more complex incident response procedures are also potential risks associated with the transition, but they are not as great as inadequate data encryption. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 5, Section 5.2.1.1, page 245.

The primary objective of aggregating the impact of IT risk scenarios and reflecting the results in the enterprise risk register is to ensure IT risk impact can be compared to the IT risk appetite, as it enables the organization to measure and evaluate the overall level and exposure of the IT risk, and to align and prioritize the IT risk response and strategy with the organizational objectives and regulations. The other options are not the primary objectives, as they are more related to the communication, assignment, or assessment of the IT risk scenarios, respectively, rather than the aggregation or reflection of the IT risk scenarios. References = CRISC Review Manual, 7th Edition, page 109.

Residual riskrefers to the risk that remains after mitigation measures have been applied. It represents the exposure that an organization decides to accept, transfer, or further address, aligning with its risk appetite and tolerance.

Risk threshold exceptions are instances when a KRI exceeds or falls below a predefined level or point that triggers an action or a warning. An increase in the number of risk threshold exceptions indicates that the KRIs are not reflecting the current risk exposure or environment accurately or effectively. This may suggest that the KRIs are outdated, irrelevant, or poorly defined. Therefore, the KRIs should be revised to ensure that they are aligned with the organizational objectives, risk appetite, and risk management strategy.
References
*Key Risk Indicators: A Practical Guide | SafetyCulture
*Key Risk Indicators: Examples & Definitions - SolveXia
*Choosing and Using Key Risk Indicators - Institute of Risk Management