Câu 126: Isaca Certified in Risk and Information Systems Control

An assessment of information security controls has identified ineffective controls. Which of the following should be the risk practitioner's FIRST course of action?

1. A. Deploy a compensating control to address the identified deficiencies
2. B. Report the ineffective control for inclusion in the next audit report
3. C. Determine if the impact is outside the risk appetite — đáp án hiện tại
4. D. Request a formal acceptance of risk from senior management