Question

During a risk assessment of a payment processing application, a CRISC practitioner discovers that a mandated data encryption control is configured but has been failing silently for three months due to an expired certificate. Management asks how this finding should be reflected in the risk analysis. What is the MOST accurate way to characterize this situation?

Accepted Answer

The residual risk should be treated as equal to the inherent risk for the affected exposure until the control is restored

Answer

The residual risk remains unchanged because the encryption control is documented and formally implemented

Answer

The finding represents a threat event that should be added to the threat landscape rather than affecting residual risk

Answer

The inherent risk should be lowered because compensating monitoring detected the certificate expiration