Information Systems Control Design and Implementation Flashcards
6 cards from real CRISC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Information Systems Control Design and Implementation flashcards as text
What is the primary objective of designing information systems controls?
Answer: To reduce risk to an acceptable level while enabling business operations to continue efficiently
Controls must balance risk reduction with operational efficiency — overly restrictive controls can impede business processes as much as the risks they are meant to prevent.
What is the difference between a general control and an application control?
Answer: General controls govern the overall IT environment; application controls are specific to individual systems or processes
General controls (like change management and access administration) apply broadly across the IT environment, while application controls (like input validation) operate within specific applications.
Which principle requires that no single individual has control over all phases of a critical process?
Answer: Segregation of duties (SoD)
Segregation of duties ensures that fraud or error requires collusion by splitting critical tasks across multiple individuals so no single person can complete a harmful act alone.
What is the principle of least privilege in information systems control?
Answer: Users and systems should have only the minimum access rights required to perform their authorized functions
Least privilege limits access to the minimum necessary for each role, reducing the attack surface and limiting the damage that can be caused by compromised accounts or insider threats.
What is the purpose of input validation controls in application systems?
Answer: To ensure that data entered into a system meets defined criteria before processing, preventing corrupt or malicious data
Input validation controls check that data conforms to expected format, type, and range before processing, preventing issues like SQL injection, data corruption, and processing errors.
Which control type is designed to reduce the severity of an incident after it has occurred?
Answer: Corrective control
Corrective controls restore systems and processes to normal after an incident, such as disaster recovery procedures, patch management, and incident response plans.