CRISC: Certified in Risk and Information Systems ControlDemo

Question

An operations manager has requested risk acceptance after a mitigation plan has failed. Which of the following is the BEST response from the risk practitioner?

A Ask the risk owner to review the request.
B Document the risk acceptance in the risk register.
C Reassess the risk scenario associated with the action plan.
D Adjust the organization's risk profile by the amount of risk accepted.

Explanation

Risk acceptance must be based on the current residual-risk assessment and the organization’s risk tolerance. When a mitigation plan fails, the likelihood or impact associated with the risk scenario may differ from the planned residual risk, so the scenario should be reassessed before acceptance is considered, documented, or used to update the risk profile.

Learn more

CRISC: Certified in Risk and Information Systems ControlDemo

AstroTutor

Notes

Readiness

QuestionQ1480

Community Discussion