Isaca Certified in Risk and Information Systems Control CRISC Question # 392 Topic 40 Discussion
CRISC Exam Topic 40 Question 392 Discussion:
Question #: 392
Topic #: 40
A risk practitioner is reviewing a vendor contract and finds there is no clause to control privileged access to the organization's systems by vendor employees. Which of the following is the risk practitioner's BEST course of action?
A.
Contact the control owner to determine if a gap in controls exists.
B.
Add this concern to the risk register and highlight it for management review.
C.
Report this concern to the contracts department for further action.
D.
Document this concern as a threat and conduct an impact analysis.
According to the CRISC Review Manual1, the contracts department is responsible for drafting, reviewing, and negotiating contracts with vendors and other third parties. The contracts department should ensure that the contracts include adequate clauses and terms to address the risks and controls related to the vendor services and activities. Therefore, the best course of action for the risk practitioner when finding a missing clause to control privileged access to the organization’s systems by vendor employees is to report this concern to the contracts department for further action. The contracts department can then revise the contract to include the necessary clause, or seek alternative solutions to mitigate the risk of unauthorized or inappropriate access by vendor employees. References = CRISC Review Manual1, page 229.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit