Section: Volume C
Explanation:
The activity duration estimates review is valuable in identifying risks associated to the time allowances for the activities or projects as a whole, with a width of the range indicating the degrees of risk.
Incorrect Answers:
B: The activity cost estimates review is valuable in identifying risks as it provides a quantitative assessment of the expected cost to complete scheduled activities and is expressed as a range, with a width of the range indicating the degrees of risk.
C: A Risk management plan is a document arranged by a project manager to estimate the effectiveness, predict risks, and build response plans to mitigate them. It also consists of the risk assessment matrix.
D: It describes how the schedule contingencies will be reported and assessed.

Documented procedures are the best way to enable effective IT control implementation. Documented procedures are the specific actions or steps that are performed to achieve the IT control objectives and mitigate the IT risks. Documented procedures provide clear guidance, consistency, and accountability for the IT control activities. Documented procedures also help to monitor and evaluate the effectiveness and efficiency of the IT controls, and to identify and address any gaps or weaknesses. The other options are not as effective as documented procedures, although they may support or complement the IT control implementation. Key risk indicators (KRIs) are metrics that measure the likelihood and impact of IT risks, but they do not specify how to implement the IT controls. Information security policies and standards are high-level statements that define the IT security goals and requirements, but they do not detail how to implement the IT controls. References = Risk and Information Systems Control Study Manual, Chapter 1, Section 1.3.2, page 1-15.

and B are incorrect as they are extraneous choices and are not applicable.

Explanation/Reference:
Explanation:
Data validation ensures that extracted data are ready for analysis. One objective is to perform data quality tests to ensure data are valid complete and free of errors. This may also involve making data from different sources suitable for comparative analysis.
Incorrect Answers:
A: Analysis of data involves simple set of steps or complex combination of commands and other functionality. Data analysis is designed in such a way to achieve the stated objectives from the project plan. Although this may be applicable to any monitoring activity, it would be beneficial to consider transferability and scalability. This may include robust documentation, use of software development standards and naming conventions.
C: Data gathering is the process of collecting data on risk to be monitored, prepare a detailed plan and define the project's scope. In the case of a monitoring project, this step should involve process owners, data owners, system custodians and other process stakeholders.
D: In the data access process, management identifies which data are available and how they can be acquired in a format that can be used for analysis. There are two options for data extraction:
Extracting data directly from the source systems after system owner approval

Receiving data extracts from the system custodian (IT) after system owner approval

According to the CRISC Review Manual1, authorizing user access requests is the process of granting or denying access to IT resources based on the user's role, responsibilities, and business needs. Authorizing user access requests is a key control accountability that should be retained within the organization, as it helps to ensure that the principle of least privilege is applied, and that the access rights are aligned with the organization's policies, standards, and risk appetite. Authorizing user access requests also helps to prevent unauthorized access, data leakage, fraud, and other potential risks associated with user access provisioning and termination. Therefore, the best control accountability to retain within the organization when a third-party vendor offers to perform user access provisioning and termination is authorizing user access requests.
References = CRISC Review Manual1, page 240.