When Residual Risk Exceeds Risk Appetite
During a risk assessment, a security manager discovers that the residual risk after implementing planned controls is still above the risk appetite threshold. What should the manager do NEXT?
Quick Answer
The answer is to escalate the residual risk to senior management. When residual risk exceeds risk appetite after planned controls have been applied, the security manager lacks the authority to accept that level of exposure; risk acceptance is a strategic decision reserved for senior leadership, who can authorize additional budget, modify controls, or adjust the risk appetite threshold. On the Certified Information Security Manager CISM exam, this scenario tests your understanding of the governance hierarchy within Information Security Risk Management—specifically that operational staff identify and treat risk, but only management can formally accept residual risk above appetite. A common trap is choosing to “implement more controls” immediately, but the correct next step is escalation, not action. Remember the mnemonic: “Exceed appetite? Escalate the plight.”
⚠ Common exam trap
Candidates often confuse operational risk acceptance (which a manager can do for low risks) with management-level risk acceptance required when residual risk exceeds the appetite threshold, leading them to incorrectly choose Option B.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Escalate the residual risk to senior management
When residual risk exceeds the risk appetite threshold after planned controls, the security manager cannot simply accept or ignore it; the risk must be escalated to senior management because they hold the authority to decide whether to accept the risk, allocate additional budget for further controls, or adjust the risk appetite. This aligns with the CISM domain of Information Security Risk Management, where risk acceptance is a management decision, not an operational one.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement additional controls immediately
Why it's wrong here
Implementing controls immediately skips the required evaluation of cost, feasibility and alternative treatments, and may exceed the risk appetite's intent. Additional controls are one valid treatment, but selection must follow analysis and business-owner consultation. The next step is to present options and obtain a treatment decision rather than act unilaterally.
- ✗
Document the risk as accepted
Why it's wrong here
Accepting residual risk requires formal sign-off by the business owner, not the security manager, and only after options such as additional controls or risk transfer are evaluated. Documentation alone leaves the exposure unaddressed; acceptance is valid only when the organisation consciously decides the risk is tolerable.
- ✓
Escalate the residual risk to senior management
Why this is correct
Escalating the residual risk to senior management satisfies the governance requirement when risk exceeds the appetite threshold. Senior management owns risk acceptance decisions beyond delegated authority, so the manager must present the residual exposure for a formal accept, mitigate further, or reject decision rather than absorbing it silently.
- ✗
Reassess the risk using a different methodology
Why it's wrong here
Changing methodology does not reduce the measured exposure; it merely recalculates it, and could mask the gap. Reassessment is warranted when the existing method is demonstrably flawed, not when the result is unwelcome. The manager must instead treat the above-threshold residual risk through further mitigation, transfer or formal acceptance.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CISM exam frequently reuses these exact scenarios with slightly different constraints.
✓Escalate the residual risk to senior managementCorrect answer▾
Why this is correct
Escalating the residual risk to senior management satisfies the governance requirement when risk exceeds the appetite threshold. Senior management owns risk acceptance decisions beyond delegated authority, so the manager must present the residual exposure for a formal accept, mitigate further, or reject decision rather than absorbing it silently.
✗Implement additional controls immediatelyWrong answer — click to see why▾
Why this is wrong here
While additional controls may be an option, the immediate next step is to escalate and get a decision.
✗Document the risk as acceptedWrong answer — click to see why▾
Why this is wrong here
Acceptance requires authorization from management, not unilateral action by the security manager.
✗Reassess the risk using a different methodologyWrong answer — click to see why▾
Why this is wrong here
Changing methodology may give different numbers but doesn't address the underlying issue.
Analysis generated from the official CISMblueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
One of 924 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CISM
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. Based on the risk register extract, which risk should the information security manager prioritize for additional treatment?
hard- A.R-001 only
- B.Neither risk requires additional treatment
- C.R-002 only
- ✓ D.Both R-001 and R-002
Why D: Both R-001 and R-002 have residual risk levels exceeding the risk appetite of 5 (R-001: 9, R-002: 6). According to standard risk management practice, any residual risk above the appetite threshold requires additional treatment. Although R-002 has a higher inherent risk (24 vs. 12), the priority for treatment is determined by the gap between residual risk and appetite. R-001's gap of 4 is larger than R-002's gap of 1, indicating a more urgent need for treatment. Therefore, both risks require additional treatment.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.