When Residual Risk Exceeds Risk Appetite
During a risk assessment, a security manager discovers that the residual risk after implementing planned controls is still above the risk appetite threshold. What should the manager do NEXT?
Quick Answer
The answer is to escalate the residual risk to senior management. When residual risk exceeds risk appetite after planned controls have been applied, the security manager lacks the authority to accept that level of exposure; risk acceptance is a strategic decision reserved for senior leadership, who can authorize additional budget, modify controls, or adjust the risk appetite threshold. On the Certified Information Security Manager CISM exam, this scenario tests your understanding of the governance hierarchy within Information Security Risk Management—specifically that operational staff identify and treat risk, but only management can formally accept residual risk above appetite. A common trap is choosing to “implement more controls” immediately, but the correct next step is escalation, not action. Remember the mnemonic: “Exceed appetite? Escalate the plight.”
⚠ Common exam trap
Candidates often confuse operational risk acceptance (which a manager can do for low risks) with management-level risk acceptance required when residual risk exceeds the appetite threshold, leading them to incorrectly choose Option B.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Escalate the residual risk to senior management
When residual risk exceeds the risk appetite threshold after planned controls, the security manager cannot simply accept or ignore it; the risk must be escalated to senior management because they hold the authority to decide whether to accept the risk, allocate additional budget for further controls, or adjust the risk appetite. This aligns with the CISM domain of Information Security Risk Management, where risk acceptance is a management decision, not an operational one.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement additional controls immediately
Why it's wrong here
While additional controls may be an option, the immediate next step is to escalate and get a decision.
- ✗
Document the risk as accepted
Why it's wrong here
Acceptance requires authorization from management, not unilateral action by the security manager.
- ✗
Reassess the risk using a different methodology
Why it's wrong here
Changing methodology may give different numbers but doesn't address the underlying issue.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CISM exam frequently reuses these exact scenarios with slightly different constraints.
✓Escalate the residual risk to senior managementCorrect answer▾
✗Implement additional controls immediatelyWrong answer — click to see why▾
Why this is wrong here
While additional controls may be an option, the immediate next step is to escalate and get a decision.
✗Document the risk as acceptedWrong answer — click to see why▾
Why this is wrong here
Acceptance requires authorization from management, not unilateral action by the security manager.
✗Reassess the risk using a different methodologyWrong answer — click to see why▾
Why this is wrong here
Changing methodology may give different numbers but doesn't address the underlying issue.
Analysis generated from the official CISMblueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
One of 871 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CISM
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. Based on the risk register extract, which risk should the information security manager prioritize for additional treatment?
hard- A.R-001 only
- B.Neither risk requires additional treatment
- C.R-002 only
- ✓ D.Both R-001 and R-002
Why D: Both R-001 and R-002 have residual risk levels exceeding the risk appetite of 5 (R-001: 9, R-002: 6). According to standard risk management practice, any residual risk above the appetite threshold requires additional treatment. Although R-002 has a higher inherent risk (24 vs. 12), the priority for treatment is determined by the gap between residual risk and appetite. R-001's gap of 4 is larger than R-002's gap of 1, indicating a more urgent need for treatment. Therefore, both risks require additional treatment.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.