CRISC: Certified in Risk and Information Systems ControlDemo

Question

A risk practitioner has been asked to designate an identified control deficiency as remediated, despite concerns that the risk level remains too high. Which option is the BEST way to address this concern?

A Recommend implementation of additional compensating controls.
B Review the organization’s risk appetite and tolerance.
C Assess the residual risk against the organization’s risk appetite.
D Prepare a risk acceptance proposal for senior management's consideration

Explanation

Control remediation must be evaluated based on the residual risk after the remediation. Comparing that residual risk with the organization’s approved risk appetite determines whether the risk is acceptable or whether additional treatment or formal risk acceptance is necessary.

CRISC: Certified in Risk and Information Systems ControlDemo

AstroTutor

Notes

Readiness

QuestionQ722

Community Discussion