hardMultiple ChoiceObjective-mapped
CRISC Practice Question: A company has a low risk appetite but high risk…
A company has a low risk appetite but high risk tolerance. Which of the following scenarios is consistent with this situation?
⚠ Common exam trap
Watch out — candidates often confuse risk appetite (the willingness to take risk) with risk tolerance (the capacity to withstand risk), leading candidates to incorrectly associate high tolerance with accepting high risk, when in fact high tolerance allows for acceptance of residual risk after controls are applied.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The company invests heavily in cybersecurity controls but accepts some residual risk
A low risk appetite means the company is unwilling to accept high levels of risk, while high risk tolerance indicates it can absorb the financial or operational impact of residual risk that remains after controls are applied. Investing heavily in cybersecurity controls reduces inherent risk to a low residual level, aligning with the low appetite, and the acceptance of some residual risk is consistent with the high tolerance. This scenario reflects a balanced approach where controls are prioritized to meet appetite, and tolerance allows for manageable leftover risk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The company avoid controls and accepts high risk
Why it's wrong here
Low appetite would not allow high risk acceptance without controls.
- ✓
The company invests heavily in cybersecurity controls but accepts some residual risk
Why this is correct
Low appetite drives control investment; high tolerance allows acceptance of remaining risk within bounds.
- ✗
The company has aggressive growth targets and accepts any IT risk
Why it's wrong here
That indicates high risk appetite, not low.
- ✗
The company invests minimally in controls and has low residual risk
Why it's wrong here
Minimal investment would likely result in high residual risk, conflicting with low appetite.
Go deeper
Related to this question
About these practice questions
One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.