hardMultiple Choice
CRISC Practice Question: A company's risk management team is evaluating…
A company's risk management team is evaluating the effectiveness of its control monitoring program. They find that many controls are tested at the same time each year, leading to a resource bottleneck. Which of the following approaches would BEST address this issue?
⚠ Common exam trap
A common mix-up: candidates choose 'Implement continuous monitoring automation' (Option C) because it sounds modern and efficient, but the question specifically asks for the BEST approach to address a resource bottleneck caused by timing, not the method of testing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Stagger testing cycles across the year
Staggering testing cycles across the year distributes the workload evenly, preventing the resource bottleneck caused by testing all controls simultaneously. This approach optimizes resource utilization without increasing headcount or reducing coverage, directly addressing the root cause of the scheduling conflict.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Increase the testing team size
Why it's wrong here
Increasing headcount leaves the annual testing schedule untouched, so the same clustered workload recurs each year; it consumes budget without redistributing effort. Continuous control monitoring, by contrast, spreads testing across the cycle. Adding testers would suit a one-off backlog or a permanent rise in transaction volume, not a timing-driven bottleneck.
- ✓
Stagger testing cycles across the year
Why this is correct
Staggering testing cycles distributes control assessments across the calendar year, directly relieving the annual resource bottleneck identified in the stem. Continuous monitoring becomes feasible because testing effort is levelled rather than concentrated, sustaining coverage without requiring additional headcount or reducing the scope of controls assessed.
- ✗
Implement continuous monitoring automation
Why it's wrong here
Continuous monitoring automation addresses control testing frequency, not the annual scheduling bottleneck; it would not stagger assessments across the year. It is tempting because continuous monitoring suits high-risk controls needing real-time assurance, where automated evidence collection replaces periodic manual testing entirely.
- ✗
Reduce the number of controls tested
Why it's wrong here
Reducing the number of controls tested lowers assurance coverage rather than smoothing the testing schedule, so the annual bottleneck recurs while residual risk rises. It tempts because de-scoping genuinely low-risk or duplicate controls is valid during control rationalisation, but that removes monitoring, not the timing clash that continuous or rolling testing resolves.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 1,062-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.