Question 388:
When reviewing management`s IT control self-assessments, a risk practitioner noted an ineffective control that links to several low residual risk scenarios. What should be the NEXT course of action?
Answer options:
A. Propose mitigating controls B. Assess management`s risk tolerance C. Recommend management accept the low risk scenarios D. Re-evaluate the risk scenarios associated with the control