CRISC: Certified in Risk and Information Systems ControlDemo

Question

Before establishing a response strategy for a particular risk scenario, it is MOST important to confirm that:

A the risk register has been reviewed by management.
B annual less expectancy (ALE) is less than the remediation cost.
C compensating controls are available.
D the risk rating exceeds risk appetite.

Explanation

Risk treatment is driven by whether the assessed level of risk is greater than the organization’s defined risk appetite. If the rating remains within appetite, the organization may accept the risk; if it exceeds appetite, a response strategy is required to reduce, transfer, avoid, or otherwise address it.

CRISC: Certified in Risk and Information Systems ControlDemo

AstroTutor

Notes

Readiness

QuestionQ988

Community Discussion