Enforcing segregation of duties between the vendor master file and invoicing is the best process control to mitigate the risk of an employee issuing fraudulent payments to a vendor. This is because segregation of duties is a key internal control that prevents or detects errors, fraud, or abuse by ensuring that no single person can perform incompatible or conflicting tasks. The vendor master file is a database that contains the information and settings for each vendor, such as name, address, bank account, payment terms, etc. Invoicing is the process of generating and sending bills to the vendors for the goods or services they provide. If the same person can access and modify the vendor master file and issue invoices, he or she could create fictitious vendors, alter vendor information, or generate false or duplicate invoices, and then divert the payments to his or her own account. By segregating these duties, the organization can reduce the opportunity and likelihood of such fraudulent activities. According to the CRISC Review Manual 2022, segregation of duties is one of the key IT control objectives and practices1. According to the web search results, segregation of duties between the vendor master file and invoicing is a common and recommended control to prevent vendor fraud

The most important factor for sustainable development of secure IT services is security training for systems development staff. Security training helps to ensure that the staff members are aware of the security risks, requirements, and best practices that affect the IT services they develop. Security training also helps to improve the security skills and knowledge of the staff members, and to foster a security culture and behavior within the development team. Security training can also help to prevent or reduce security defects, vulnerabilities, or incidents in the IT services, and to enhance the security performance and quality of the IT services. Well-documented business cases, security architecture principles, and secure coding practices are also important factors for sustainable development of secure IT services, but they are not as important as security training for systems development staff. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 5, Section 5.1.1.2, page 2291
1: ISACA Certified in Risk and Information Systems Control (CRISC) Exam Guide, Answer to Question
653.

The first step in establishing an ethical governance culture is tocreate a clear and formal policyoutlining acceptable behavior and consequences for violations.
ISACA guidance:
"Developing and approving an enterprise code of ethics or ethical policy establishes the foundation for enforcing ethical conduct and guiding all subsequent training and enforcement activities." Training and enforcement follow policy creation.
Therefore,D. Create a policy regarding ethical behavioris correct.
CRISC Reference:Domain 1 - IT Risk Governance, Topic: Ethics and Governance Policies.

* Business Impact Analysis (BIA):
* Objective: The primary objective of a BIA is to identify and evaluate the effects of disruptions on business operations. This includes determining the criticality of IT assets that support key business processes.
* Risk Mitigation: By identifying critical IT assets, organizations can prioritize risk mitigation efforts to ensure that key business processes remain operational during and after disruptions.
* Appropriate IT Risk Mitigation:
* Critical Asset Identification: Knowing which IT assets are essential allows for targeted risk mitigation strategies. This ensures resources are allocated efficiently to protect the most important systems.
* Impact Assessment: Understanding the impact of potential disruptions on critical IT assets helps in developing effective disaster recovery and continuity plans.
* Comparison with Other Options:
* Validating Critical IT Risk: While important, this is typically part of a broader BIA process rather than its primary objective.
* Assigning Accountability for IT Risk: This is crucial for governance but does not directly enable risk mitigation actions.
* Defining IT Risk-aware Culture: Important for overall risk management but does not directly influence specific mitigation actions.
* Best Practices:
* Detailed Asset Inventory: Maintain an up-to-date inventory of IT assets and their dependencies on business processes.
* Regular Updates and Reviews: Continuously update the BIA to reflect changes in the IT environment and business processes.
References:
* CRISC Review Manual: Emphasizes the role of BIA in identifying critical IT assets and supporting risk mitigation strategies .
* ISACA Standards: Outline the importance of aligning IT risk management with business continuity planning through effective BIAs .

Zero Trustassumes that no system or user is inherently trustworthy-even within the internal network. It addresses theinadequacy of perimeter securityby enforcing continuous verification for every access request.
Reference:CRISC Manual - Domain 2, Slide 128-129