No absolutes
- Rule
- No absolutes
- Exam
- CISA & CISM
- What it means
Options that say always, never, all or eliminate are rarely right. Security and audit are about reducing risk to an acceptable level.
- The trap answer looks like
Options promising to eliminate all risk, guarantee compliance or prevent every incident.
- The winning answer looks like
Options that reduce risk to an acceptable level.
- Worked example
Which is the PRIMARY purpose of a control framework?
- ❌ To guarantee compliance
- ✅ To provide a structured basis for governing and managing I&T
Watch for always, never, all, guarantee and eliminate.