The correct answer is that the company invests heavily in cybersecurity controls but accepts some residual risk. This scenario aligns with a low risk appetite, meaning the organization is unwilling to take on significant risk, while high risk tolerance means it can financially or operationally absorb the leftover risk that remains after controls are applied. By prioritizing robust controls, the company reduces inherent risk to a low residual level, satisfying its low appetite, and then accepts that manageable leftover risk, which fits its high tolerance. On the CRISC exam, this question tests your ability to distinguish between appetite (the amount of risk willingly pursued) and tolerance (the acceptable deviation from that appetite). A common trap is confusing the two: a low appetite does not mean zero risk, and high tolerance does not mean seeking risk. Remember the mnemonic “Appetite sets the limit, tolerance handles the leftover.”
CRISC IT Risk Assessment Practice Question
This CRISC practice question tests your understanding of it risk assessment. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company has a low risk appetite but high risk tolerance. Which of the following scenarios is consistent with this situation?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The company invests heavily in cybersecurity controls but accepts some residual risk
A low risk appetite means the company is unwilling to accept high levels of risk, while high risk tolerance indicates it can absorb the financial or operational impact of residual risk that remains after controls are applied. Investing heavily in cybersecurity controls reduces inherent risk to a low residual level, aligning with the low appetite, and the acceptance of some residual risk is consistent with the high tolerance. This scenario reflects a balanced approach where controls are prioritized to meet appetite, and tolerance allows for manageable leftover risk.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
The company avoid controls and accepts high risk
Why it's wrong here
Low appetite would not allow high risk acceptance without controls.
✓
The company invests heavily in cybersecurity controls but accepts some residual risk
Why this is correct
Low appetite drives control investment; high tolerance allows acceptance of remaining risk within bounds.
Related concept
Read the scenario before looking for a memorised answer.
✗
The company has aggressive growth targets and accepts any IT risk
Why it's wrong here
That indicates high risk appetite, not low.
✗
The company invests minimally in controls and has low residual risk
Why it's wrong here
Minimal investment would likely result in high residual risk, conflicting with low appetite.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is confusing risk appetite (the willingness to take risk) with risk tolerance (the capacity to withstand risk), leading candidates to incorrectly associate high tolerance with accepting high risk, when in fact high tolerance allows for acceptance of residual risk after controls are applied.
Detailed technical explanation
How to think about this question
In risk management, risk appetite is the amount of risk an organization is willing to pursue or retain, while risk tolerance is the acceptable variation around that appetite—often expressed as thresholds for specific metrics like monetary loss or downtime. For example, a company with a low appetite might set a maximum acceptable loss of $50,000 per incident, but with high tolerance, it can absorb losses up to $200,000 before triggering escalation. This distinction is critical when designing control frameworks (e.g., NIST SP 800-37) where control selection must map to appetite, and residual risk acceptance is documented in the risk register.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A practitioner preparing for the CRISC exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
IT Risk Assessment — This question tests IT Risk Assessment — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: The company invests heavily in cybersecurity controls but accepts some residual risk — A low risk appetite means the company is unwilling to accept high levels of risk, while high risk tolerance indicates it can absorb the financial or operational impact of residual risk that remains after controls are applied. Investing heavily in cybersecurity controls reduces inherent risk to a low residual level, aligning with the low appetite, and the acceptance of some residual risk is consistent with the high tolerance. This scenario reflects a balanced approach where controls are prioritized to meet appetite, and tolerance allows for manageable leftover risk.
What should I do if I get this CRISC question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.