The best way to prevent future occurrences of active network accounts belonging to former employees is to conduct a comprehensive review of access management processes. This review should include verifying that the access rights of all employees are updated regularly, especially when they change roles or leave the organization. The review should also ensure that there are clear policies and procedures for granting, modifying, and revoking access rights, and that these are followed consistently and documented properly. The review should also identify and address any gaps or weaknesses in the access management processes that could lead to unauthorized or inappropriate access. By conducting a comprehensive review of access management processes, the organization can improve its security posture and reduce the risk of data breaches or misuse of resources. References = IT audit: The ultimate guide [with checklist] | Zapier, IT auditing and controls - planning the IT audit [updated 2021]

Section: Volume D

According to the CRISC Review Manual (Digital Version), the best course of action when a risk assessment has identified that an organization may not be in compliance with industry regulations is to conduct a gap analysis against compliance criteria, which is a method of comparing the current state of compliance with the desired or required state of compliance. Conducting a gap analysis against compliance criteria helps to:
* Identify and evaluate the differences or discrepancies between the compliance requirements and the actual compliance practices and capabilities
* Assess the impact and severity of the compliance gaps on the organization's objectives and performance
* Prioritize the compliance gaps based on their urgency and importance
* Develop and implement appropriate actions or measures to close or reduce the compliance gaps
* Monitor and measure the effectiveness and efficiency of the actions or measures taken to address the compliance gaps References = CRISC Review Manual (Digital Version), Chapter 1: IT Risk Identification, Section 1.5: IT Risk Identification Methods and Techniques, pp. 34-351

is incorrect. Risk response plans are implemented as part of the monitoring and
controlling process group.