hardMultiple ChoiceObjective-mapped
KRI Threshold Breach: First Step — Validate Data and Investigate Root Cause
A company's key risk indicator (KRI) for 'failed login attempts' has exceeded its threshold by 20%. The control owner reports that a recent firewall change caused false positives. What should the risk practitioner do FIRST?
Quick Answer
The correct first step when a KRI threshold breach occurs is to validate the data and investigate the root cause. This is because a threshold breach may result from a data integrity issue—such as a configuration error or false positive—rather than an actual increase in risk exposure. In the CRISC exam, this scenario tests your understanding of the risk response lifecycle, emphasizing that verification must precede any corrective or escalatory action. A common trap is jumping to remediation or escalation without confirming the breach is real, which wastes resources and undermines the risk management process. Remember the memory tip: “Verify before you rectify”—always confirm the data’s accuracy and the underlying cause before deciding on a response.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Validate the KRI data and investigate the root cause
The first step when a KRI threshold is breached is to validate the data and investigate the root cause to determine if the breach is real or due to a false positive. The control owner's report of a firewall change causing false positives requires verification before any corrective action. Option B is premature because implementing additional controls without confirmation may address symptoms not the true cause. Option C is too drastic without understanding the impact of reverting the change. Option D would undermine the KRI's effectiveness and should only be considered after thorough analysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Validate the KRI data and investigate the root cause
Why this is correct
Data integrity check is essential before any action.
- ✗
Implement additional controls to reduce failed logins
Why it's wrong here
Should verify data first; controls may be unnecessary.
- ✗
Revert the firewall change immediately
Why it's wrong here
Could disrupt business; need confirmation first.
- ✗
Increase the KRI threshold to eliminate false positives
Why it's wrong here
Threshold manipulation without analysis hides risk.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 983 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CRISC
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has implemented a key risk indicator (KRI) for system availability, with a threshold of 99.5%. The monitoring team observes that availability has dropped to 99.2% for two consecutive months. What is the most appropriate next step?
medium- A.Implement additional redundancy to improve availability.
- B.Increase the threshold to 99.0% to avoid false alarms.
- ✓ C.Notify the risk owner and initiate a root cause analysis.
- D.Escalate immediately to the board of directors.
Why C: A sustained breach of a KRI threshold (99.2% vs. 99.5%) for two consecutive months indicates a systemic issue that requires formal risk management action. The risk owner must be notified to assess the impact, and a root cause analysis (RCA) should be initiated to identify underlying failures—such as network congestion, hardware faults, or software bugs—before any remediation is planned.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.