và các quá trình hoặc chức năng mới đang được giới thiệu. Tình trạng này cho phép giảm thiểu rủi ro bởi vì thử nghiệm tích hợp và thử nghiệm hồi quy có thể đánh giá không chỉ thay đổi cùng một lúc mà còn là sự tương tác của những thay đổi này với các ứng dụng và mỗi khác. | 462 Chapter Ị 15. The Annual Loss Expectancy ALE of a risk without controls is expected to be 35 000 to a business process you are evaluating. You are recommending a control that will save 80 percent of that loss at an annual cost of 20 000 over the life of the process. Is the control justifiable A. No the savings is insignificant and relative to the cost. B. Yes 80 percent of the loss amounts to 28 000 per year which exceeds the annual cost by 8 000 per year. C. No ALE is a subjective number and cannot be depended on to make this decision. D. Maybe it depends on the managementÕs appetite for risk and loss. 16. What is the most important aspect of risk analysis to keep in mind when reviewing a business process A. Senior management must be held accountable for all risks to the business. B. All risks do not need to be eliminated for a business to be profitable. C. Risks must be identified and documented in order to perform proper analysis on them. D. Line management should be involved in the risk analysis because management sees risks daily that others would not recognize. 17. Before making a recommendation to management for the further mitigation of residual risk during a gap analysis in a risk assessment the following considerations should be decided upon I. Management s risk tolerance II. The best type of control for the risk scenario and the process III. The gap between the acceptable risk and the residual risk IV. The state of the art best practice for the process being reviewed V. Additional risk mitigation that the proposed control would address for the process under review A. I II III and V only B. II III and V only C. II III IV and V only D. I II III IV and V Business Process Evaluation and Risk Management 463 18. What is the primary reason for independent assurance as a requirement for relying on control assessment and evaluation A. The review of controls by independent reviewers transfers some amount of the risk to the reviewing body or organization. B. IS
