CRISC: Certified in Risk and Information Systems ControlDemo

Question

Which of the following is the BEST action for a risk practitioner when a project team has accepted a risk that is outside the established risk appetite?

A Monitor the residual risk level of the accepted risk.
B Escalate the risk decision to the project sponsor for review.
C Document the risk decision in the project risk register.
D Reject the risk acceptance and require mitigating controls.

Explanation

Risk appetite defines the boundary of risk the organization is willing to accept. Acceptance beyond that boundary is a governance exception that requires review by the accountable sponsor or other authorized escalation authority. Monitoring or recording the decision does not authorize the exception, and a risk practitioner does not ordinarily override the team’s decision unilaterally.

Learn more

CRISC: Certified in Risk and Information Systems ControlDemo

AstroTutor

Notes

Readiness

QuestionQ727

Community Discussion