Control testing is the process of verifying that the risk mitigation controls are designed and operating effectively, and that they achieve the intended objectives and outcomes. Control testing can involve various methods, such as observation, inspection, inquiry, re-performance, or simulation. Control testing results can provide evidence and assurance that the implementation of a risk mitigation control has been completed as intended, and that the control is functioning properly and consistently. Control testing results can also identify any issues or deficiencies in the control design or operation, and recommend corrective actions or improvements. The other options are not as helpful as control testing results, because they do not provide a direct and objective verification of the control implementation, but rather focus on other aspects or outputs of the risk management process, as explained below:
* A. An updated risk register is a document that records and tracks the identified risks, their characteristics, and their status. An updated risk register can reflect the changes in the risk profile and exposure after the implementation of a risk mitigation control, but it does not verify that the control
* implementation has been completed as intended, or that the control is effective and reliable.
* B. Risk assessment results are the outputs of the risk analysis and evaluation process, which measure the impact and likelihood of the risks, and assign a risk rating and priority. Risk assessment results can indicate the level of risk exposure and the need for risk mitigation controls, but they do not verify that the control implementation has been completed as intended, or that the control is effective and reliable.
* C. Technical control validation is the process of ensuring that the technical aspects of a control, such as hardware, software, or network components, are configured and functioning correctly. Technical control validation can verify that the control implementation meets the technical specifications and requirements, but it does not verify that the control implementation has been completed as intended, or that the control is effective and reliable from a business perspective. References = Risk and Information Systems Control Study Manual, Chapter 4, Section 4.3.3, page 130.

Explanation/Reference:
Explanation:
An enterprise's risk management capability maturity level is 3 when:
Risk management is viewed as a business issue, and both the drawbacks and benefits of risk are

recognized.
There is a selected leader for risk management, engaged with the enterprise risk committee, across the

enterprise.
The business knows how IT fits in the enterprise risk universe and the risk portfolio view.

Local tolerances drive the enterprise risk tolerance.

Risk management activities are being aligned across the enterprise.

Formal risk categories are identified and described in clear terms.

Situations and scenarios are included in risk awareness training beyond specific policy and structures

and promote a common language for communicating risk.
Defined requirements exist for a centralized inventory of risk issues.

Workflow tools are used to accelerate risk issues and track decisions.

Incorrect Answers:
C: Enterprise having risk management capability maturity level 5 requires continuous improvement of risk management skills, based on clearly defined personal and enterprise goals.

Explanation/Reference:
Explanation:
Integrated change control is responsible for facilitating, documenting, and dispersing information on a proposed change to the project scope.
Integrated change control is a way to manage the changes incurred during a project. It is a method that manages reviewing the suggestions for changes and utilizing the tools and techniques to evaluate whether the change should be approved or rejected. Integrated change control is a primary component of the project's change control system that examines the affect of a proposed change on the entire project.
Incorrect Answers:
A: The configuration management system controls and documents changes to the project's product C: The change log documents approved changes in the project scope.
D: The scope change control system controls changes that are permitted to the project scope.