CRISC: Certified in Risk and Information Systems ControlDemo

By Isaca · Question Mode

QuestionQ487

Risk Response and Reporting

Which of the following should a risk practitioner validate first when a mitigating control cannot be fully implemented in support of business objectives?

  • A If the risk owner has accepted the risk
  • B If compensating controls have been implemented
  • C If insurance coverage has been obtained
  • D If business objectives continue to align with organizational goals
Explanation

Risk responses and mitigating controls must support business objectives that are aligned with organizational goals. Confirming that alignment first establishes whether the objective—and therefore the incomplete control implementation and related residual risk—remains justified before considering compensating controls, insurance, or risk acceptance.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!