According to the CRISC Review Manual1, stakeholders are the individuals or groups that have an interest or stake in the outcome of the IT system and its risks. Stakeholders include the system owners, users, operators, developers, managers, auditors, regulators, and customers. It is most important to ensure that agreement is obtained from stakeholders when testing the security of an IT system, as this helps to define the scope, objectives, and expectations of the test, and to obtain the necessary authorization, support, and resources for the test. Agreement from stakeholders also helps to avoid any conflicts, disruptions, or misunderstandings that may arise during or after the test, and to ensure the validity and acceptance of the test results and recommendations. References = CRISC Review Manual1, page 198, 224.

* A risk heat map is a graphical tool that displays the results of a risk analysis in a matrix format, using colors and symbols to indicate the level and priority of the risks. A risk heat map can show the distribution and comparison of the risks based on various criteria, such as likelihood, impact, category, source, etc.
* A risk heat map is most commonly used as part of an IT risk analysis to facilitate risk assessment, which is the process of determining the significance and urgency of the risks that may affect the organization's objectives and operations. Risk assessment involves measuring and comparing the likelihood and impact of various risk scenarios, and prioritizing them based on their magnitude and importance.
* A risk heat map can help to facilitate risk assessment by providing a visual and intuitive representation of the risk profile, and highlighting the most critical and relevant risks that need to be addressed or
* monitored. A risk heat map can also help to communicate and report the risk analysis results to different stakeholders, and to support the decision making and planning for the risk response and treatment.
* The other options are not the most common uses of a risk heat map as part of an IT risk analysis, because they do not address the main purpose and benefit of a risk heat map, which is to facilitate risk assessment.
* Risk identification is the process of finding and describing the risks that may affect the organization's objectives and operations. Risk identification involves defining the risk sources, events, causes, and impacts, and documenting them in a risk register. A risk heat map is not commonly used to facilitate risk identification, because it does not provide the detailed and comprehensive information that is needed to identify and describe the risks, and it may not cover all the relevant or potential risks that may exist or emerge.
* Risk treatment is the process of selecting and implementing the appropriate actions or plans to address the risks that have been identified, analyzed, and evaluated. Risk treatment involves choosing one of the following types of risk responses: mitigate, transfer, avoid, or accept. A risk heat map is not commonly used to facilitate risk treatment, because it does not provide the specific and feasible information that is needed to select and implement the risk responses, and it may not reflect the cost-benefit or feasibility analysis of the risk responses.
* Risk communication is the process of exchanging and sharing the information and knowledge about the risks and their responses among the relevant stakeholders. Risk communication involves informing, consulting, and involving the stakeholders in the risk management process, and ensuring that they understand and agree on the risk objectives, criteria, and outcomes. A risk heat map is not commonly used to facilitate risk communication, because it does not provide the complete and accurate information that is needed to communicate and share the risks and their responses, and it may not address the different needs, expectations, and perspectives of the stakeholders. References =
* ISACA, CRISC Review Manual, 7th Edition, 2022, pp. 19-20, 23-24, 27-28, 31-32, 40-41, 47-48,
54-55, 58-59, 62-63
* ISACA, CRISC Review Questions, Answers & Explanations Database, 2022, QID 169
* CRISC Practice Quiz and Exam Prep

Section: Volume D

Section: Volume A
Explanation:
Probability that an actual return on an investment will be lower than the investor's expectations is termed as investment risk or expense risk. All investments have some level of risk associated with it due to the unpredictability of the market's direction. This includes consideration of the overall IT investment portfolio.
Incorrect Answers:
A: The risk that data cannot be relied on because they are unauthorized, incomplete or inaccurate is termed as integrity risks.
B: The risk of IT projects failing to meet objectives due to lack of accountability and commitment is referring to as project risk ownership.
C: The risk associated with not receiving the right information to the right people (or process or systems) at the right time to allow the right action to be taken is termed as relevance risk.