Exam CRISC Topic 10 Question 1394 Discussion

The observation that would be of GREATEST concern to a risk practitioner reviewing the implementation
status of management action plans is that management has not begun the implementation, because it indicates
that the management action plans are not being executed or monitored, and that the risks are not being
addressed or mitigated. The lack of implementation may also imply that the management action plans are not
realistic, feasible, or aligned with the enterprise's strategy and objectives. The other options are not as
concerning as the lack of implementation, because:
Option A: Management has not determined a final implementation date is a concern, but not the greatest one,
because it may affect the timely completion and delivery of the management action plans, but it does not
necessarily mean that the management action plans are not being executed or monitored.
Option B: Management has not completed an early mitigation milestone is a concern, but not the greatest one,
because it may indicate a delay or deviation in the progress and performance of the management action plans,
but it does not necessarily mean that the management action plans are not being executed or monitored.
Option C: Management has not secured resources for mitigation activities is a concern, but not the greatest
one, because it may affect the quality and effectiveness of the management action plans, but it does not
necessarily mean that the management action plans are not being executed or monitored. References = Risk
and Information Systems Control Study Manual, 7th Edition, ISACA, 2020, p. 123.