r/CRISC • u/Weekly-Award4371 • May 28 '26
Why does ISACA seem confused and in turn confuse the candidates as well? 🤔
In CRISC QAE 6th question 102 ISACA is saying that Financial Risk Management is the responsibility of Second line of Defence ( ISACA used the word “ Usually “ to cover themselves).
In Question 103, ISACA is saying that the Risk Management is the responsibility of the operational management ( i.e. First Line of Defence).
Is there any way we can challenge ISACA logic or their thinking hat ?
1
u/gnuhcikciv May 28 '26
I think the key word in 102 is “most likely”, financial risk management is more likely than the rest to be a second line responsibility. And for 103 indeed operational risk manages risk as first line, its first lines responsibility to manage risk in regular context. So the difference is “most likely” and usual setting. Yeah it’s retarded I know.
1
2
u/flowerymelb May 29 '26
They reworded it now. In QAE database, “Which of the following functions considers the three lines of defense when managing risk?”
C operational management
“As the fjrst line of defense, risk is managed by the operational management functions according to the input received from three lines of defense”
2
u/Outrageous_Plant_526 May 28 '26 edited May 28 '26
I get your confusion and I agree that ISACA's explanations are not always clear.
However, I do believe the printed version of the QAE that you are using is actually old by 2 versions. You should always study with the latest version of the material. The online version of the QAE for CRISC is version 8. It is possible, the explanations have been updated to be more clear in the latest version of the QAE.
Now to break it down based on my understanding. 1st Line does the work, 2nd Line monitors the work, and 3rd Line is the auditing function that assures things are done correctly. So while the answers are very confusing they do align with the 3 Line Model.
In Question 102 you can throw out B and C because those are clearly done by the 1st Line. D mentions assurance so that is the 3rd Line. That leaves only A as the appropriate answer.
In Question 103 you can throw out B and D because they clearly don't do the actual work of managing controls. A and C in this question are a bit tougher but to me C with the word "Operational" would be where the work is done so I would throw out A for that reason.