Câu 40: Isaca Certified in Risk and Information Systems Control

During the risk assessment of an organization that processes credit cards, a number of existing controls have been found to be ineffective and do not meet industry standards. The overall control environment may still be effective if:

1. A. a control mitigation plan is in place
2. B. residual risk is accepted
3. C. compensating controls are in place — đáp án hiện tại
4. D. risk management is effective