Free CRISC Practice Test Questions and Answers (2026)

The primary reason for periodic penetration testing of Internet-facing applications is to identify

vulnerabilities in the system, because this will help to improve the security and resilience of the

applications and the data they process. A penetration test is a simulated cyberattack that aims to

exploit the weaknesses and gaps in the security of an application or a system. A penetration test can

reveal the vulnerabilities that may not be detected by other methods, such as automated scanning

or code review. A penetration test can also measure the impact and severity of the vulnerabilities, as

well as the effectiveness of the existing controls and defenses. A penetration test can also provide

recommendations and solutions to remediate the vulnerabilities and prevent future attacks.

Internet-facing applications are programs and services that are accessible from the internet, such as

web applications, APIs, cloud services, or VPN gateways. Internet-facing applications are exposed to

a variety of cyber threats, such as denial-of-service attacks, SQL injection attacks, cross-site scripting

attacks, or credential stuffing attacks. These threats can compromise the confidentiality, integrity,

and availability of the applications and the data they handle. Therefore, periodic penetration testing

of Internet-facing applications is essential to identify vulnerabilities in the system and to protect the

applications and the data from cyberattacks. Reference = Web Application Penetration Testing: A

Practical Guide - BrightSecurity1, The Basics of Web Application Penetration Testing | Turing2,

Periodic Penetration Testing: What is the best pentesting frequency …

The risk associated with malicious functionality in outsourced application development is that the

vendor may introduce unauthorized or harmful code into the enterprise’s system, which could

compromise its security, integrity, or performance.

To mitigate this risk, the enterprise should perform an in-depth code review with an expert who can

verify that the code meets the specifications, standards, and quality requirements, and that it does

not contain any malicious or unwanted functionality.

A code review is a systematic examination of the source code of a software program, which can

identify errors, vulnerabilities, inefficiencies, or deviations from best practices. A code review can

also ensure that the code is consistent, readable, maintainable, and well-documented.

An expert is someone who has the knowledge, skills, and experience to perform the code review

effectively and efficiently. An expert may be an internal or external resource, depending on the

availability, cost, and independence of the reviewer.

A code review should be performed before the code is deployed to the production environment, and

preferably at multiple stages of the development life cycle, such as design, testing, and integration.

A code review can also be complemented by other techniques, such as automated code analysis,

testing, and scanning tools, which can detect common or known issues in the code. Reference =

ISACA, CRISC Review Manual, 7th Edition, 2022, p. 143

ISACA, CRISC Review Questions, Answers & Explanations Database, 2022, QID 143

A comparison of current risk levels with established tolerance is the most useful information for

senior management when determining an appropriate risk response, as it shows the gap between

the actual risk exposure and the desired risk exposure of the enterprise. This gap indicates the need

and urgency for risk response actions, and helps senior management to prioritize and allocate

resources for risk mitigation. A comparison of current risk levels with established tolerance also

reflects the effectiveness of the existing risk management process and controls, and enables senior

management to monitor and adjust the risk strategy and objectives accordingly. Reference = ISACA

Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers,

A data classification program helpsidentify appropriate controlsby categorizing data based on

sensitivity and criticality. This ensures that data protection measures are aligned with its value and

risk level, improving overall security posture.

The primary reason to report the information about the new risk scenarios identified after the

implementation of Internet of Things (IoT) devices to risk owners is to confirm the impact to the risk

profile. The risk profile is a summary of the level and nature of the risks that the organization faces or

may face in the future. The risk profile reflects the risk appetite, tolerance, and capacity of the

organization, and guides the risk management decisions and actions. The implementation of IoT

devices may introduce new risks or increase the likelihood or impact of existing risks, such as data

privacy, security, or interoperability issues. Therefore, the information about the new risk scenarios

should be reported to the risk owners, who have the authority and responsibility for managing the

risks and their responses, to confirm the impact to the risk profile and to determine the appropriate

risk treatment plans. The other options are not asprimary as confirming the impact to the risk profile,

as they are related to the reevaluation, mitigation, or recommendation of the IoT devices, not the

confirmation or assessment of the risk profile. Reference = Risk and Information Systems Control

Study Manual, Chapter 1: IT Risk Identification, Section 1.2: IT Risk Register, page 19.

Zero Trust Model:

Zero Trust security model assumes that threats can exist both inside and outside the network. Every

access request must be authenticated, authorized, and encrypted.

Preventing Control Gaps:

A robust technical architecture ensures comprehensive and consistent security controls across the

entire network.

It integrates various security measures, such as microsegmentation, strong authentication,

continuous monitoring, and least privilege access, to create a unified defense strategy.

Other Options:

Relying on Multiple Solutions:Can lead to fragmentation and inconsistencies in security controls.

Utilizing Rapid Development:May introduce vulnerabilities if security is not properly integrated.

Starting with a Large Initial Scope:Can be overwhelming and difficult to manage effectively, leading

to potential gaps.

Reference:

The CISSP Study Guide emphasizes the importance of a strong and cohesive technical architecture in

implementing Zero Trust effectively (Sybex CISSP Study Guide, Chapter 8: Principles of Security

Models, Design, and Capabilities) .

An increase in the number of security incidents is the most significant indicator of the need to

perform a penetration test, because it suggests that the organization’s IT systems or networks are

vulnerable to attacks and may not have adequate security controls in place. A penetration test is a

simulated attack on an IT system or network to identify and exploit its weaknesses and evaluate its

security posture. A penetration test can help to discover and remediate the vulnerabilities that may

have caused or contributed to the security incidents, and to prevent or reduce the likelihood and

impact of future incidents. An increase in the number of high-risk audit findings, an increase in the

percentage of turnover in IT personnel, and an increase in the number of infrastructure changes are

all possible indicators of the need to perform a penetration test, but they are not the most significant

indicator, as they do not directly reflect the actual or potential occurrence of security incidents.

Reference = Risk and Information Systems Control Study Manual, Chapter 5, Section 5.3.2, page 200

The best course of action for a system administrator who suspects a colleague may be intentionally

weakening a system’s validation controls in order to pass through fraudulent transactions is B. Share

the concern through a whistleblower communication channel1

According to the CRISC Review Manual, a whistleblower communication channel is a mechanism that

allows employees to report suspected fraud or unethical behavior without fear of retaliation or

reprisal. A whistleblower communication channel is part of an effective fraud detection and

prevention framework, and it helps to promote a culture of integrity and accountability within the

organization2

The other options are not as effective or appropriate as sharing the concern through a whistleblower

communication channel, because:

•A. Implementing compensating controls to deter fraud attempts may not address the root cause of

the problem, and it may also create additional complexity and cost for the system. Moreover, it may

not prevent the colleague from finding other ways to bypass the controls or collude with external

parties.

•C. Monitoring the activity to collect evidence may expose the system administrator to legal or

ethical risks, especially if the monitoring is done without proper authorization or due process. Itmay

also delay the reporting and resolution of the issue, and potentially allow more fraudulent

transactions to occur.

•D. Determining whether the system environment has flaws that may motivate fraud attempts may

be useful for understanding the context and the factors that contribute to the fraud risk, but it does

not address the immediate concern of reporting the suspected fraud. It may also imply that the

system administrator is trying to justify or rationalize the colleague’s behavior, rather than holding

them accountable.

1: CRISC Review Questions, Answers & Explanations Database, Question ID: 100002 2: CRISC Review

Manual, 7th Edition, page 224

A control is an action or measure that reduces the likelihood or impact of a risk to an acceptable

level. A control issue is a problem or weakness that affects the effectiveness or efficiency of a

control, such as a gap, deficiency, or failure. A control enhancement is an improvement or

modification that increases the effectiveness or efficiency of a control, such as by adding, replacing,

or updating the control. An external audit is an independent and objective examination of the

enterprise’s activities, processes, or systems, such as the risk management program or thecontrol

environment, by an external party, such as a regulator or a third-party auditor. The best way for a risk

practitioner to verify that management has addressed control issues identified during a previous

external audit is to observe the control enhancements in operation. This will enable the risk

practitioner to evaluate the actual performance and outcome of the control enhancements, and to

determine whether they have resolved or mitigated the control issues. The other options are not the

best way to verify that management has addressed control issues, as they involve different methods

or sources of verification:

Interview control owners means that the risk practitioner asks questions or collects feedback from

the persons or groups who have the authority and accountability to manage the controls and their

issues, such as the business process owners or the IT controls managers. This may provide some

information or evidence on the control enhancements, but it may not be as reliable orobjective as

observing the control enhancements in operation, as the control owners may have biases, conflicts,

or gaps in their knowledge or perception of the control enhancements.

Inspect external audit documentation means that the risk practitioner reviews the reports or records

of the external audit, such as the audit findings, recommendations, or opinions. This may provide

some information or evidence on the control issues, but it may not be as current or relevant as

observing the control enhancements in operation, as the external audit documentation may not

reflect the latest or updated status or results of the control enhancements, or may not cover all the

aspects or components of the control enhancements.

Review management’s detailed action plans means that the risk practitioner examines the

documents that specify the actions to be taken by the management to address the control issues,

such as the resources required, the timelines, the owners, and the expected outcomes. This may

provide some information or evidence on the control enhancements, but it may not be as accurate or

sufficient as observing the control enhancements in operation, as the management’s detailed action

plans may not match the actual implementation or execution of the control enhancements, or may

not account for the uncertainties or complexities of the control enhancements. Reference = Risk and

Information Systems Control Study Manual, 7th Edition, Chapter 2, Section 2.3.3.1, pp. 62-63.

A risk scenario is a hypothetical situation that describes how a risk event could adversely affect an

organization’s objectives, assets, or operations. A risk scenario can be used for riskanalysis,which is

the process of estimating the likelihood and impact of the risk event, and evaluating the

effectiveness and efficiency of the risk response1.

One of the essential components of a risk scenario is the threat type, which is the source or cause of

the risk event. The threat type can be classified into various categories, such as natural, human,

technical, environmental, or legal. The threat type can help to define the characteristics, motivations,

capabilities, and methods of the risk event, and to identify the potential vulnerabilities and

exposures of the organization. The threat type can also help to determine the frequency and severity

of the risk event, and to select the appropriate risk response strategies and controls23.

The other options are not the components of a risk scenario, but rather the outcomes or inputs of

risk analysis. Risk appetite is the amount and type of risk that an organization is willing to accept in

pursuit of its objectives. Risk appetite can help to guide the risk analysis by providing a high-level

statement of the desired level of risk taking and tolerance4. Risk tolerance is the acceptable variation

in the outcomes related to specific objectives or risks. Risk tolerance can help to measure the risk

analysis by providing quantitative or qualitative indicators of the acceptable range of risk exposure

and performance4. Residual risk is the remaining risk after the risk response has been implemented.

Residual risk can help to monitor the risk analysis by providing feedback on the effectiveness and

efficiency of the risk response and the need for further action. Reference =

Risk Analysis - ISACA

Threat - ISACA

Threat Modeling - ISACA

Risk Appetite and Risk Tolerance - ISACA

[Residual Risk - ISACA]

[CRISC Review Manual, 7th Edition]

The level of risk in the IT risk profile is the aggregate measure of the likelihood and impact of IT-

related risks that may affect the enterprise’s objectives and operations.

The risk appetite is the amount and type of risk that the enterprise is willing to accept in pursuit of its

goals. It is usually expressed as a range or a threshold, and it is aligned with the enterprise’s strategy

and culture.

If the level of risk in the IT risk profile has decreased and is now below management’s risk appetite, it

means that the enterprise has more capacity and opportunity to take on additional risks that may

offer higher rewards or benefits.

The best recommendation in this situation is to optimize the control environment, which is the set of

policies, procedures, standards, and practices that provide the foundation for managing IT risks and

controls. Optimizing the control environment means enhancing the efficiency and effectiveness of

the controls, reducing the costs and complexity of compliance, and aligning the controls with the

enterprise’s objectives and values.

Optimizing the control environment can help the enterprise to achieve the optimal balance between

risk and return, and to leverage its risk management capabilities to create and protect value.

The other options are not the best recommendations, because they do not address the opportunity

to improve the enterprise’s performance and resilience.

Realigning risk appetite to the current risk level may result in missing out on potential gains or

advantages that could be obtained by taking more risks within the acceptable range.

Decreasing the number of related risk scenarios may reduce the scope and depth of risk analysis and

reporting, and impair the enterprise’s ability to identify and respond to emerging or changing risks.

Reducing the risk management budget may compromise the quality and reliability of the risk

management process and activities, and weaken the enterprise’s risk culture and

governance. Reference =

ISACA, CRISC Review Manual, 7th Edition, 2022, pp. 29-30, 34-35, 38-39, 44-45

ISACA, CRISC Review Questions, Answers & Explanations Database, 2022, QID 145

An IT risk register is a document that records the identified IT risks, their analysis, and their

responses. It is a useful tool for managing and communicating the IT risks throughout the project or

the organization. The most important factor for maintaining the effectiveness of an IT risk register is

to perform regular reviews and updates to the register, meaning that the riskpractitioner should

periodically check and revise the riskregister to reflect the changes in the IT risk environment, the

project status, or the organization’s objectives. Performing regular reviews and updates to the

register can help to ensure that the risk register is accurate, complete, and current, and that it

provides relevant and reliable information for the risk management decision making and actions.

Performing regular reviews and updates to the register can also help to identify any new or emerging

IT risks, as well as to monitor and report on the IT risk performance and improvement. Reference =

Risk and Information Systems Control Study Manual, Chapter 3, Section 3.2.1, p. 106-107

The primary consideration when implementing controls for monitoring user activity logs is ensuring

that the control is proportional to the risk, because this helps to optimize the balance between the

benefits and costs of the control, and to avoid over- or under-controlling the risk. User activity logs

are records of the actions or events performed by users on IT systems, networks, or resources, such

as accessing, modifying, or transferring data or files. Monitoring user activity logs can help to detect

and prevent potential threats, such as unauthorized access, data leakage, or malicious activity, and to

support the investigation and remediation of incidents. However, monitoring user activity logs also

involves certain costs and challenges, such as collecting, storing, analyzing, and reporting large

amounts of log data, ensuring the accuracy, completeness, and timeliness of the log data, protecting

the privacy and security of the log data, and complying with the relevant laws and regulations.

Therefore, when implementing controls for monitoring user activity logs, the organization should

consider the level and impact of the risk that the control is intended to address, and the value and

effectiveness of the control in reducing the risk exposure and impact. The organization should also

consider the costs and feasibility of implementing and maintaining the control, and the potential

negative consequences or side effects of the control, such as performance degradation, user

dissatisfaction, or legal liability. By ensuring that the control is proportional to the risk, the

organization can achieve the optimal level of risk management, and avoid wasting resources or

creating new risks. Reference = Risk IT Framework, ISACA, 2022, p. 151

Failure to utilize threat modeling during the design phase results in overlooked vulnerabilities. This

highlights the importance ofProactive Threat Identificationin secure software development practices.

Project risk register: A document that records the identified risks, their likelihood, impact, and

mitigation strategies for a project1.

Project steering committee: A group of senior stakeholders and experts who oversee and support a

project from a higher level2.

Risk mitigation actions: The measures taken to prevent, reduce, or transfer the risks that may affect a

project3.

The most important objective of regularly presenting the project risk register to the project steering

committee is to track the status of risk mitigation actions. Tracking the status of risk mitigation

actions can help the project steering committee to:

Monitor and measure the performance and effectiveness of the risk management process and

controls

Evaluate the progress and outcomes of the risk mitigation actions against the project goals and

objectives

Identify and resolve any issues, challenges, or gaps in the risk mitigation actions

Provide guidance, feedback, and support to the project manager and the project team

Adjust or revise the risk mitigation actions as needed to reflect the changes in the project scope,

schedule, budget, or environment

The other options are not the most important objective of regularly presenting the project risk

register to the project steering committee, although they may be relevant or beneficial. Allocating

budget for resolution of risk issues, which means assigning financial resources to address and resolve

the risks that may affect a project, may be a part of the risk management process, but it is not the

primary purpose of presenting the project risk register, which is more focused on tracking and

reporting the risk status and actions. Determining if new risk scenarios have been identified, which

means finding out if there are any additional or emerging risks that may impact a project, may be a

useful outcome of presenting the project risk register, but it is not the main objective, which is more

concerned with tracking and reporting the existing risk status and actions. Ensuring the project

timeline is on target, which means verifying that the project is progressing according to the planned

schedule and milestones, may be a benefit of presenting the project risk register, but it is not the key

objective, which is more related to tracking and reporting the risk status and actions.

Reference = Risk Register: A Project Manager’s Guide with Examples [2023] • Asana, Project Steering

Committee: Roles, Best Practices, Challenges, Risk Mitigation: Definition, Strategies, and Examples

An organization may rely on third-party vendors to provide some of its IT systems, applications, or

services, such as cloud computing, software development, or data processing. The organization

should evaluate the control environment of the third-party vendors, which is the set of policies,

procedures, and practices that establish the tone and culture of the vendor’s risk management and

control activities. The best way to evaluate the control environment of severalthird-party vendors is

to obtain independent control reports from high-risk vendors. Independent control reports are the

documents that attest to the design, implementation, and effectiveness of the vendor’s controls,

based on the standards or frameworks that are relevant and applicable for the vendor’s services,

such as the ISAE 3402 or the SOC 2. Independentcontrol reports are prepared by independent and

qualified auditors, who provide an objective and reliable assessment of the vendor’s controls. High-

risk vendors are the vendors that pose the highest level of risk to the organization, such as by having

access to sensitive or confidential data, or by providing critical or complex services. By obtaining

independent control reports from high-risk vendors, the organization can verify that the vendor’s

controls are adequate and appropriate for the organization’s needs, and that the vendor complies

with thecontractual and regulatory requirements. The other options are not as good as obtaining

independent control reports from high-risk vendors, as they may not provide sufficient or consistent

information or evidence on the vendor’s control environment:

Review vendors’ internal risk assessments covering key risk and controls means that the organization

examines the vendor’s own evaluation of its risks and controls, such as by reviewing the vendor’s risk

register, risk matrix, or risk report. This may provide some information or insight on the vendor’s

control environment, but it may not be as reliable or objective as obtaining independent control

reports, as the vendor’s internal risk assessments may have biases, conflicts, or gaps in their

methodology, scope, or quality.

Review vendors performance metrics on quality and delivery of processes means that the

organization measures and monitors the vendor’s performance and outcomes, such as by using key

performance indicators (KPIs), service level agreements (SLAs), or customer satisfaction surveys. This

may provide some information or feedback on the vendor’s control environment, but it may not be

as comprehensive or relevant as obtaining independent control reports, as the vendor’s performance

metrics may not cover all the aspects or components of the vendor’s controls, or may not reflect the

latest or updated status or results of the vendor’s controls.

Obtain vendor

from third parties means that the organization collects and verifies the

testimonials or recommendations of the vendor’s services from other customers or stakeholders,

such as by contacting them directly or by reading their reviews or ratings. This may provide some

information or evidence on the vendor’s control environment, but it may not be as accurate or

consistent as obtaining independent control reports, as the vendor’s references from third parties

may have biases, conflicts, or variations in their expectations, experiences, or opinions of the

vendor’s services. Reference = Risk and Information Systems Control Study Manual, 7th Edition,

Chapter 4, Section 4.1.2.1, pp. 147-148.

The lack of due diligence for the recommended cloud vendor should be of greatest concern to the

risk practitioner, because it exposes the organization to potential risks and issues related to the

security, reliability, performance, and compliance of the cloud service provider. Due diligence is a

process of conducting a thorough investigation and evaluation of a potential vendor or partnerbefore

entering into a contractual relationship. Due diligence helps to verify the vendor’s credentials,

capabilities, reputation, and track record, and to identify any red flags or gaps that may affect the

quality or suitability of the service. Cloud computing is a model of delivering IT services over the

internet, where the service provider owns and manages the IT infrastructure, platforms, or

applications, and the customer pays only for the resources or functions they use. Cloud computing

can offer cost savings, scalability, and flexibility for the business, but it also introduces new risks and

challenges, such as data privacy, security breaches, vendor lock-in, service outages, or regulatory

compliance. Therefore, performing due diligence for the recommended cloud vendor is essential to

ensure that the organization’s expectations and requirements are met, and that the risks and issues

are identified and addressed. The business introducing new SaaS solutions without IT approval, the

maintenance of IT infrastructure being outsourced to an IaaS provider, and the architecture

responsibilities not being clearly defined are all possible concerns for the risk practitioner, but they

are not the greatest concern, as they can bemitigated or resolved with appropriate controls, policies,

or agreements. Reference = Risk and Information Systems Control Study Manual, Chapter 5, Section

5.2.1, page 183

Communication of Risk Assessment Results:Ensuring data owners understand the results of risk

assessments allows them to make informed decisions on where to focus their efforts.

Prioritization:Data owners can prioritize their actions based on the assessed risk levels, ensuring that

resources are allocated efficiently to mitigate the most significant risks.

Reference:

CRISC Review Manual, Chapter 3: Risk Response and Reporting, details the importance of

communicating risk assessment results for effective risk management and response prioritization  .

A vulnerability report for the IT infrastructure is a document that identifies and evaluates the

weaknesses or gaps in the IT systems, networks, or devices that could be exploited by threats or

cause incidents. By analyzing the latest vulnerability report, one can conclude the existence and

extent of control weaknesses in the IT infrastructure, because control weaknesses are the

deficiencies or failures of the controls that are supposed to prevent, detect, or correct the

vulnerabilities. The other options are not the correct answers, because they are not directly

concluded by analyzing the latest vulnerability report. The likelihood of a threat, the impact of

technology risk, and the impact of operational risk are examples of risk factors or consequencesthat

depend on the vulnerability and the threat, but they are not determined by the vulnerability report

alone. Reference = CRISC: Certified in Risk & Information Systems Control Sample Questions

IT risk scenarios are hypothetical situations or occurrences that illustrate the potential impact of IT-

related threats or opportunities on the organization’s objectives, performance, or value creation12.

Business risk scenarios are hypothetical situations or occurrences that illustrate the potential impact

of business-related threats or opportunities on the organization’s objectives, performance, or value

creation34.

The best way for the risk practitioner to address the concerns of the business executives who

question why they have been assigned ownership of IT-related risk scenarios is to describe IT risk

scenarios in terms of business risk, which is a technique that involves translating and communicating

the IT risk scenarios into the language and context of the business risk scenarios, and highlighting the

linkages and dependencies between them56.

Describing IT risk scenarios in terms of business risk is the best way because it helps the business

executives to understand and appreciate the relevance and importance of IT risk scenarios, andhow

they affect the achievement of the organization’s goals and the delivery of value to the

stakeholders56.

Describing IT risk scenarios in terms of business risk is also the best way because it helps the business

executives to accept and fulfill their roles and responsibilities as the owners of IT risk scenarios, and

to collaborate and coordinate with the IT team and other stakeholders in the risk management

process56.

The other options are not the best ways, but rather possible alternatives or supplements that may

support or enhance the description of IT risk scenarios in terms of business risk. For example:

Recommending the formation of an executive risk council to oversee IT risk is a way that involves

establishing and empowering a group of senior leaders from different business units and functions to

provide the strategic direction, guidance, and oversight for the IT risk

managementprocess78. However, this way is not the best way because it does not directlyaddress

the concerns of the business executives who question why they have been assigned ownership of IT

risk scenarios, and it may not be feasible or effective without a clear and common understanding of

IT risk scenarios among the council members78.

Providing an estimate of IT system downtime if IT risk materializes is a way that involves quantifying

and communicating the potential loss or disruption of the IT systems or services that support the

organization’s operations, if the IT risk scenarios occur9 . However, this way is not the best way

because it does not fully capture or convey the impact of IT risk scenarios on the organization’s

objectives, performance, or valuecreation, and it may not be relevant or meaningful for some IT risk

scenarios that are not related to IT system downtime9 .

Educating business executives on IT risk concepts is a way that involves providing and delivering the

knowledge and skills on the principles, frameworks, and techniques of IT risk management, and the

roles and responsibilities of the IT risk owners and stakeholders . However, this way is not the best

way because it does not specifically address the concerns of the business executives who question

why they have been assigned ownership of IT risk scenarios, and it may not be sufficient or effective

without a practical and contextual application of IT risk concepts to the organization’s situation and

goals . Reference =

1: IT Scenario Analysis in Enterprise Risk Management - ISACA2

2: New Toolkit and Course From ISACA Help Practitioners Develop Risk Scenarios - ISACA1

3: Business Risk - Investopedia3

4: Business Risk: Definition, Types, Examples & How to Manage4

5: Risk IT Framework, ISACA, 2009

6: IT Risk Management Framework, University of Toronto, 2017

7: Executive Risk Council - ISACA5

8: Executive Risk Council: A Guide to Success6

9: IT System Downtime - ISACA7

IT System Downtime: Causes, Costs, and How to Prevent It8

IT Risk Education - ISACA9

IT Risk Education: A Guide to Success