CRISC: Certified in Risk and Information Systems ControlDemo

Question

An organization has concluded that a risk scenario falls outside the defined risk-tolerance level. What should be the NEXT course of action?

A Develop a compensating control
B Identify risk responses
C Allocate remediation resources
D Perform a cost-benefit analysis

Explanation

A risk that exceeds the defined tolerance requires identification and evaluation of risk response options. Actions such as designing compensating controls, allocating remediation resources, and conducting a cost-benefit analysis support the selection or implementation of an appropriate response but are not the initial next action.

CRISC: Certified in Risk and Information Systems ControlDemo

AstroTutor

Notes

Readiness

QuestionQ1830

Community Discussion