Controls should be incorporated into system specifications in the design phase of the system development life cycle (SDLC), because this is the phase where the system requirements are translated into detailed specifications and architectures that define how the system will be built and operated. Incorporating controls in the design phase ensures that the system is secure, reliable, and compliant from the start, and reduces the cost and complexity of implementing controls later in the SDLC. The other options are not the correct answers, because they are not the phases where controls are incorporated into system specifications. The implementation phase is the phase where the system is installed, configured, and tested. The development phase is the phase where the system is coded, integrated, and tested. The feasibility phase is the phase where the system concept and scope are defined and evaluated. References = CRISC: Certified in Risk & Information Systems Control Sample Questions

The greatest concern of maintaining independent departmental risk registers that are not automatically aggregated is that management may be unable to accurately evaluate the risk profile. The risk profile is the overall view of the risks that the organization faces and their impact on the organization's objectives. It helps management to prioritize and allocate resources for risk management and to align the risk appetite and strategy. If the departmental risk registers are not aggregated, management may not have a complete and consistent picture of the risks across the organization. They may miss some important risks, overestimate or underestimate some risks, or have conflicting or redundant risk information. This may lead to poor risk management decisions and outcomes. The other options are also concerns, but they are not as critical as the inability to evaluate the risk profile. References = Risk and Information Systems Control Study Manual, Chapter 2: IT Risk Assessment, Section 2.2: IT Risk Analysis, page 63.

The primary reason to report the information about the new risk scenarios identified after the implementation of Internet of Things (IoT) devices to risk owners is to confirm the impact to the risk profile. The risk profile is a summary of the level and nature of the risks that the organization faces or may face in the future. The risk profile reflects the risk appetite, tolerance, and capacity of the organization, and guides the risk management decisions and actions. The implementation of IoT devices may introduce new risks or increase the likelihood or impact of existing risks, such as data privacy, security, or interoperability issues. Therefore, the information about the new risk scenarios should be reported to the risk owners, who have the authority and responsibility for managing the risks and their responses, to confirm the impact to the risk profile and to determine the appropriate risk treatment plans. The other options are not as primary as confirming the impact to the risk profile, as they are related to the reevaluation, mitigation, or recommendation of the IoT devices, not the confirmation or assessment of the risk profile. References = Risk and Information Systems Control Study Manual, Chapter 1: IT Risk Identification, Section 1.2: IT Risk Register, page 19.

Robotics process automation (RPA) is the use of software robots to perform repetitive, rules-based tasks that interact with multiple applications. RPA can help internal audit departments automate certain continuous auditing tasks, such as data extraction, validation, analysis, and reporting. RPA can improve the efficiency, quality, and coverage of internal audit activities, and provide greater insight and value to the business.
However, RPA also involves certain risks, such as errors, failures, security breaches, or compliance issues, that need to be identified, assessed, and managed. The risk associated with ineffective design of the software bots is the possibility and impact of the bots not functioning as intended, or producing inaccurate or unreliable results. The risk owner of this risk is the person or entity who has the authority and responsibility for managing the risk. The risk owner should be able to define the risk appetite, assess the risk level, select and implement the risk response, monitor and report the risk status, and ensure the risk alignment with the project objectives and strategy. The risk owner of the risk associated with ineffective design of the software bots is the project manager, who is the person in charge of planning, executing, monitoring, and closing the RPA project.
The project manager understands the project scope, requirements, budget, timeline, and deliverables, and the potential consequences of ineffective design of the software bots. The project manager also has the resources and incentives to address the risk effectively and efficiently. Therefore, the project manager is the most appropriate risk owner of the risk associated with ineffective design of the software bots. References = Robotic Process Automation for Internal Audit, p. 3-4, Adopting robotic process automation in Internal Audit, Robotic Process Automation (RPA) - Internal Audit Use and Risks.