An information system for a key business operation is being moved from an in-house application...

 Reduced ability to evaluate key risk indicators (KRIs) will have the greatest impact on the ability to monitor risk when an information system for a key business operation is moved from an in-house application to a Software as a Service (SaaS) vendor, as it may limit the visibility and control over the risk exposure and performance of the system. KRIs are metrics that measure the level of risk exposure and the effectiveness of risk response strategies, and they should be aligned with the enterprise’s risk appetite and objectives. When the system is moved to a SaaS vendor, the enterprise may lose access to the data and processes that are used to calculate and report the KRIs, or the KRIs may become irrelevant or inconsistent with the vendor’s environment and standards. This may impair the ability to monitor risk and to take timely and appropriate actions to manage risk. Reduced access to internal audit reports, dependency on the vendor’s key performance indicators (KPIs), and dependency on service level agreements (SLAs) are not the greatest impacts on the ability to monitor risk, as they do not affect the measurement and reporting of the risk status and performance, but rather the assurance and evaluation of the system quality and reliability. References = CRISC Certified in Risk andInformation Systems Control – Question221; ISACACertified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, question 221.