CISM Information Security Risk Management Practice Question
An organization has a risk appetite that allows for a maximum residual risk level of 'medium' for all operational risks. A new project introduces a risk with inherent risk level 'high' and control effectiveness rated as 'partially effective'. The risk owner proposes to accept the risk. As the CISM, what is the best course of action?
⚠ Common exam trap
A common mix-up: candidates think the risk owner's acceptance is sufficient, but CISM emphasizes that risk acceptance must be within the risk appetite; otherwise, it is a violation of governance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Insist on additional controls to reduce residual risk to at least 'medium'.
The organization's risk appetite mandates that residual risk must be at 'medium' or lower. With an inherent risk of 'high' and controls rated 'partially effective', the residual risk remains above the acceptable threshold. Therefore, the best course is to insist on additional controls to bring residual risk down to at least 'medium', ensuring compliance with the risk appetite.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Accept the risk since the risk owner has agreed.
Why it's wrong here
Acceptance is only valid if residual risk is within appetite, which it is not.
- ✗
Transfer the risk to an insurance company.
Why it's wrong here
Transfer may not eliminate the risk entirely and may not bring residual risk to acceptable level.
- ✓
Insist on additional controls to reduce residual risk to at least 'medium'.
Why this is correct
This ensures residual risk aligns with appetite, which is the correct risk management approach.
- ✗
Recommend revising the risk appetite to accommodate this risk.
Why it's wrong here
Risk appetite should be strategic, not modified for individual risks without board approval.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 871 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.