CRISC: Certified in Risk and Information Systems ControlDemo

Question

A risk owner has identified a risk that has high impact and a very low likelihood. Insurance covers the potential loss. What should the risk practitioner do next?

A Validate the risk response with internal audit.
B Update the risk register.
C Evaluate outsourcing the process.
D Recommend avoiding the risk.

Explanation

An identified risk, including its assessment and insurance-based transfer response, should be documented in the risk register so it can be tracked, owned, monitored, and reported. Insurance does not eliminate the need to record and manage the risk.

CRISC: Certified in Risk and Information Systems ControlDemo

AstroTutor

Notes

Readiness

QuestionQ765

Community Discussion