According to the FIC Article by FSCA, accountable institutions remain fully accountable, responsible and liable for any compliance failures that may result from or be associated with an outsourcing arrangement and as such, liability and/or culpability for non-compliance with the FIC Act obligations cannot be transferred to a third-party service provider2. Therefore, even if a business process is outsourced to a cloud service provider, the organization still has the ultimate responsibility and accountability for the risk associated with the outsourced process. The other options are not correct, as they imply that the cloud service provider can take over the accountability or responsibility for the risk, or that the organization can mitigate the risk by acquiring insurance, which is not the case.

CRISC maturity models describe high-maturity organizations as those where risk management is integrated into everyday operations and decision-making.
Supporting extract:
"An organization achieves mature risk management when risk principles are embedded within business operations, culture, and decision-making processes."
* A and B describe compliance-level practices.
* D shows oversight but not integration.
* C reflects operational embedding, which defines maturity.
CRISC Reference: Domain 1 - IT Risk Governance, Topic: Risk Management Maturity Model.

Software change failures typically reflect weaknesses inpreventive controls, such as code reviews, approval workflows, and test procedures. Preventive controls are designed to ensure defect-free changes before they reach production. An increase in failed changes indicates these safeguards are not functioning properly.
Corrective controls respond after failures, not before them. Administrative controls (policies and standards) guide behavior but do not directly prevent implementation errors. Deterrent controls are intended to discourage malicious behavior, not prevent unintentional change failures. Therefore, ineffective preventive controls are the root cause indicated by the KPI trend.
Reference:CRISC Review Manual - Control Types (preventive vs corrective vs detective).

A vulnerability is a system flaw or weakness that can be exploited by a threat actor, potentially leading to a security breach or incident. A vulnerability that has been exploited means that a threat actor has successfully taken advantage of the vulnerability and compromised the system or network. Implementing controls can help reduce the impact of a vulnerability that has been exploited, by limiting or preventing the damage or loss caused by the security breach or incident. Controls are the mechanisms or procedures that ensure the security, reliability, and quality of an IT system or process. Controls can be classified into different types, depending on their purpose and function. The four types of controls mentioned in the question are:
Detective control: A control that monitors and detects the occurrence or attempt of a security breach or incident, and alerts the appropriate personnel or system. For example, a log analysis tool that identifies and reports any unauthorized access or activity on the system or network.
Deterrent control: A control that discourages or prevents a threat actor from exploiting a vulnerability or performing a malicious action, by increasing the perceived difficulty, risk, or cost of doing so. For example, a warning message that informs the user of the legal consequences of unauthorized access or use of the system or network.
Preventive control: A control that blocks or stops a threat actor from exploiting a vulnerability or performing a malicious action, by eliminating or reducing the vulnerability or the opportunity.Forexample, a firewall that filters and blocks any unwanted or malicious traffic from entering or leaving the system or network.
Corrective control: A control that restores or repairs the system or network to its normal or desired state, after a security breach or incident has occurred, by fixing or removing the vulnerability or the impact. For example, a backup and recovery tool that restores the data or functionality of the system or network that has been corrupted or lost due to the security breach or incident.
The best type of control for reducing the impact of a vulnerability that has been exploited is the corrective control, because it directly addresses the damage or loss caused by the security breach or incident, and restores the system or network to its normal or desired state. Corrective controls can help minimize the negative consequences of a security breach or incident, such as downtime, data loss, reputational harm, legal liability, or regulatory sanctions. Corrective controls can also help prevent or reduce the recurrence of the security breach or incident, by fixing or removing the vulnerability that has been exploited. References = Types of Security Controls, Security Controls: What They Are and Why You Need Them, Security Controls: Definition, Types & Examples.

In the event of a data breach or misuse of confidential information, the first step is to activate the incident response plan. This ensures immediate containment, impact analysis, and communication protocols are followed.
Reference:CRISC Manual - Domain 3, Slide 291-292