The effectiveness of an employee deprovisioning process can be measured by the number of days taken to remove access after staff separation dates, as this indicates how quickly and completely the organisation can revoke the privileges of former employees and reduce the risk of unauthorized access or data leakage. The number of days taken for IT to remove access after receipt of HR instructions is a measure of the efficiency of the IT department, but not the overall process. The number of termination requests processed per reporting period is a measure of the volume of the process, but not the quality or timeliness. The number of days taken for HR to provide instructions to IT after staff separation dates is a measure of the performance of the HR department, but not the entire process. References = Risk and Information Systems Control Study Manual, Chapter 4: Risk Response, page 152.

The correct answer isBbecause the most meaningful indicator ofIT configuration management performanceis thenumber of devices adhering to baseline settings. Configuration management performance is best measured by how many devices are actually in compliance with established baseline configurations.
The other options are less effective indicators:
* A. Number of devices reviewed for compliancemeasures activity, not actual performance or outcome.
* C. Number of devices exceeding minimum configurationdoes not necessarily reflect compliance with approved baselines.
* D. Number of devices not reporting configuration datamay indicate a monitoring issue, but it does not directly measure configuration management performance.
Exact Extracts supporting the answer:
* "The control practice related to information systems architecture that includes establishing and maintaining baselines for internally developed systems is Configuration management."
* "The MOST appropriate metric to measure how well the information security function is managing the administration of user access is percent of accounts with configurations in compliance."
* "Including thresholds that identify when controls no longer provide the intended value is essential when developing metrics to monitor the control life cycle."
* "The use of key performance indicators for management of technology controls is BEST related to the measurement of control effectiveness to determine that business requirements are being met." These extracts support that configuration management should be measured againstbaseline compliance, makingdevices adhering to baseline settingsthe best indicator.

The risk practitioner's next step after identifying risk owners and responses for newly identified risk scenarios in a recent risk workshop is to update the risk register with the results, as it involves documenting and communicating the risk information and decisions, and maintaining the accuracy and completeness of the risk register. Preparing a business case for the response options, identifying resources for implementing responses, and developing a mechanism for monitoring residual risk are possible steps, but they are not the next step, as they require the prior update of the risk register with the new risk information and decisions. References = CRISC Review Manual, 7th Edition, page 109.

Key performance indicators (KPIs) are metrics or measures that provide information on the progress and performance of an organization or a team toward an intended result or objective. KPIs can help to monitor and evaluate the achievement of strategic, operational, or tactical goals, and to support the decision making and improvement of the organization or the team1.
Key control indicators (KCIs) are metrics or measures that provide information on the status and effectiveness of the controls or safeguards that are implemented to manage the risks or threats that an organization or a team faces. KCIs can help to identify and assess the strengths and weaknesses of the controls or safeguards, and to ensure the compliance and accountability of the organization or the team2.
The statement that best illustrates the relationship between KPIs and KCIs is that KPIs and KCIs both contribute to understanding of control effectiveness, because they can help to:
Measure and compare the actual and expected outcomes and impacts of the controls or safeguards, and to determine the gaps or deviations Analyze and understand the causes and consequences of the gaps or deviations, and to identify the root problems or issues Evaluate and report the performance and compliance of the controls or safeguards, and to communicate the results and feedback to the stakeholders Improve and optimize the design and implementation of the controls or safeguards, and to enhance the efficiency and effectiveness of the risk management process34 The other statements do not illustrate the relationship between KPIs and KCIs accurately, but rather some of the differences or misconceptions between them. KPIs measure manual controls, while KCIs measure automated controls is a difference between KPIs and KCIs, but not a general one. KPIs and KCIs can measure both manual and automated controls, depending on the type and nature of the controls or safeguards.A robust KCI program will replace the need to measure KPIs is a misconception about KPIs and KCIs, as they are not mutually exclusive or substitutable. KPIs and KCIs complement and support each other, as they provide different but related information on the performance and risk management of the organization or the team.
KCIs are applied at the operational level while KPIs are at the strategic level is a difference between KPIs and KCIs, but not a universal one. KPIs and KCIs can be applied at different levels of the organization or the team, depending on the scope and purpose of the measurement and evaluation. References = Key Performance Indicator (KPI): Definition, Types, and Examples Key Control Indicators - ISACA Key Control Indicators: What They Are and How to Use Them Key Performance Indicators vs. Key Control Indicators: What's the Difference?
[CRISC Review Manual, 7th Edition]

The risk owner is the person or entity that has the accountability and authority to manage a risk. The risk owner should be accountable for monitoring the control environment to ensure controls are effective, as they are responsible for implementing, maintaining, and improving the risk controls, and for reporting and communicating the risk status and performance. The risk owner should also ensure that the controls are aligned with the risk appetite and tolerance of the enterprise, and that they support the achievement of the enterprise's objectives and value creation. References = Most Asked CRISC Exam Questions and Answers. CRISC: Certified in Risk & Information Systems Control Sample Questions, Question 244.