Information Security Risk Management →hardMultiple ChoiceObjective-mapped

CISM Residual Risk Practice Question

Exhibit

Risk Register Extract:
Risk ID: R-001
Description: Unauthorized access to sensitive data
Current Controls: Firewall, Access control lists
Inherent Risk: High (Likelihood: 4, Impact: 5)
Residual Risk: Medium (Likelihood: 3, Impact: 4)
Risk Appetite: Low

Risk ID: R-002
Description: Data corruption due to malware
Current Controls: Antivirus software
Inherent Risk: High (Likelihood: 5, Impact: 4)
Residual Risk: High (Likelihood: 4, Impact: 4)
Risk Appetite: Low

Refer to the exhibit. Based on the risk register extract, which risk should the information security manager prioritize for additional treatment?

⚠ Common exam trap

Candidates often mistakenly prioritize based on inherent risk magnitude alone, ignoring that residual risk relative to appetite is the primary driver for additional treatment decisions. Here, R-002's higher inherent risk might seem more critical, but R-001's residual risk exceeds appetite by a larger margin, making it equally or more urgent.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Both R-001 and R-002

Both R-001 and R-002 have residual risk levels exceeding the risk appetite of 5 (R-001: 9, R-002: 6). According to standard risk management practice, any residual risk above the appetite threshold requires additional treatment. Although R-002 has a higher inherent risk (24 vs. 12), the priority for treatment is determined by the gap between residual risk and appetite. R-001's gap of 4 is larger than R-002's gap of 1, indicating a more urgent need for treatment. Therefore, both risks require additional treatment.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
R-001 only
Why it's wrong here
Incorrect. R-001 alone is not sufficient because R-002 also has residual risk above appetite.
✗
Neither risk requires additional treatment
Why it's wrong here
Incorrect. Both risks have residual risk above the appetite threshold, so additional treatment is needed.
✗
R-002 only
Why it's wrong here
Incorrect. While R-002 has higher inherent risk, R-001's residual risk exceeds appetite by a larger margin, so both require treatment.
✓
Both R-001 and R-002
Why this is correct
Correct. Both R-001 and R-002 have residual risk levels above the risk appetite of 5, requiring additional treatment for both.

Go deeper

CISM Residual Risk Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question