According to the CRISC Review Manual, a control owner is the person who is accountable for ensuring that specific control activities are performed. The control owner is responsible for defining, implementing, monitoring, and improving the control. Therefore, the control owner should authorize changing the control threshold value, as it is part of their role to ensure that the control is effective and efficient. The other options are not the correct answers, because they are not directly involved in the control activities. The risk owner is the person who is accountable for the risk and its associated mitigation actions. The IT security manager is the person who is responsible for overseeing the IT security function and ensuring that the IT security policy is enforced. The IT system owner is the person who is responsible for the operation and maintenance of the IT system and its associated data. References = CRISC Review Manual, 7th Edition, Chapter 3, Section 3.1.2, page 108.

Computer-enabled fraud is the use of information technology (IT) to commit or conceal fraudulent activities, such as theft, manipulation, or unauthorized access of data, systems, or networks. Computer-enabled fraud can pose significant risks to an organization, such as financial loss, reputational damage, legal liability, or regulatory sanctions. Therefore, an organization should establish a comprehensive and effective framework to prevent, detect, and respond to computer-enabled fraud. The framework should involve three lines of defense, which are the roles and responsibilities of different functions within theorganization to manage and control risks. The first line of defense consists of the business owners, whose role is to identify, assess, and manage risks, including computer-enabled fraud risks. The primary responsibility of the first line of defense related to computer-enabled fraud is to implement processes to detect and deter fraud. This means designing and executing controls that can prevent or reduce the occurrence of computer-enabled fraud, such as authentication, authorization, encryption, logging, or segregation of duties. This also means monitoring and reporting any suspicious or anomalous activities or transactions that may indicate computer-enabled fraud, such as unusual patterns, volumes, or frequencies of data or system access or usage. Implementing processes to detect and deter fraud can help the first line of defense to protect the organization's assets, data, and reputation from computer-enabled fraud, and to comply with the organization's policies and regulations. References = Three Lines of Defence, Roles of Three Lines of Defense for Information Security and Governance, THE THREE LINES OF DEFENSE IN EFFECTIVE RISK MANAGEMENT AND CONTROL, The Three Lines of Defense.

AI in Heuristic Security Systems:
* Heuristic security systems use artificial intelligence (AI) to identify and respond to potential threats by learning from data patterns and behaviors.
Risk of Misclassification:
* During the baselining process, AI systems establish what is considered normal behavior. If malicious activity is present during this period, it may be incorrectly classified as normal.
* This misclassification can lead to undetected security breaches, as the system will not recognize these activities as threats in the future.
Impact of Misclassification:
* Misclassified malicious activities can lead to significant security risks, allowing attackers to operate undetected within the system.
* It undermines the effectiveness of the heuristic system, reducing its ability to protect the organization from real threats.
Comparing Other Risks:
* Less Reliance on Human Intervention: This is a general concern but does not directly impact the accuracy of threat detection.
* Difficulty in Risk Assessments: While a challenge, it is not the greatest risk compared to misclassification of malicious activity.
* Outdated Patterns: While a concern, the primary risk lies in initial misclassification during baselining.
References:
* The CRISC Review Manual discusses the challenges of AI in security systems, particularly the risk of misclassification during the learning phase (CRISC Review Manual, Chapter 4: Information Technology and Security, Section 4.7.4 Artificial Intelligence) .

KRIs provide predictive metrics to monitor changes in risk levels, enabling timely interventions to maintain risks within the organization's appetite. This aligns with theRisk Monitoring and Reportingframework, which emphasizes proactive identification of risk thresholds.

Periodically reviewing big data strategies is the best option to minimize the risk of inaccurate data, because it allows the organization to assess the quality, validity, and reliability of the data sources and the analytics methods. It also enables the organization to identify and address any gaps, errors, or inconsistencies in the data and the results. By reviewing the big data strategies, the organization can ensure that the data analytics are aligned with the business objectives and the risk appetite.
Establishing an intellectual property agreement is not relevant to the risk of inaccurate data, as it is a legal measure to protect the ownership and use of the data, not its quality or accuracy.
Evaluating each of the data sources for vulnerabilities is a good practice, but it is not sufficient to minimize the risk of inaccurate data, as it only focuses on the security aspect of the data, not the validity or reliability of the data itself.
Benchmarking to industry best practice is a useful way to compare the performance and results of the data analytics, but it does not directly address the risk of inaccurate data, as it assumes that the data and the methods are already valid and reliable. References = Risk IT Framework, 2nd Edition, ISACA, 2019, page 62-
63.