A root cause analysis is a systematic process of identifying the underlying factors that caused the noncompliant conditions during the review of a control procedure. A root cause analysis can help to prevent the recurrence of the noncompliance, improve the effectiveness of the control procedure, and enhance the risk management process. A root cause analysis can be performed using various tools and techniques, such as the 5 whys, fishbone diagram, Pareto chart, or fault tree analysis. The other options are not as appropriate as a root cause analysis, because they do not address the source of the problem, but rather the symptoms or consequences of the noncompliance. References = Risk and Information Systems Control Study Manual, Chapter 4, Section 4.3.3, page 130.

Explanation/Reference:
Explanation:
It is important to first understand the risk to be monitored, prepare a detailed plan and define the project's scope for monitoring risk. In the case of a monitoring project, this step should involve process owners, data owners, system custodians and other process stakeholders.
Incorrect Answers:
A: Data regarding stakeholders of the project is not required in any phase of risk monitoring.

Explanation/Reference:
Explanation:
The completed feasibility study results should include a cost/benefit analysis report that:
Provides the results of criteria analyzed (e.g., costs, benefits, risk, resources required and

organizational impact)
Recommends one of the alternatives and a course of action

Incorrect Answers:
B, C: Project management plan and risk response plan are the results of plan project management and plan risk response, respectively. They are not the result of feasibility study.

Section: Volume D
Explanation:
Project initiation section of SDLC contains information on projects initiated by sponsors who gather the information required to gain approval for the project to be created.