CRISC Risk Response and Reporting Practice Question
A credit union's risk committee has approved a risk response for its core banking platform: purchase an insurance policy against ransomware losses and keep the current backup process unchanged. Six months later, a ransomware event encrypts production data and the backup restoration takes four days, breaching regulatory reporting deadlines. Which risk response did the risk committee most likely select, and why did it fail to address the operational impact?
⚠ Common exam trap
The trap here is assuming that any purchased control or policy automatically mitigates operational risk, when insurance transfers only financial loss and leaves availability and compliance exposure intact.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Risk transfer, because insurance shifted the financial loss but did not reduce the likelihood or duration of the service outage.
The committee chose a risk transfer response by buying insurance, which addresses only the financial consequence of a ransomware loss. Because backups and recovery capabilities were left unchanged, the operational and regulatory impacts remained fully exposed, and the four-day restoration breached reporting deadlines. Effective risk response selection must consider whether the chosen treatment addresses the specific impact categories the organization cares about, not just the monetary loss.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Risk transfer, because insurance shifted the financial loss but did not reduce the likelihood or duration of the service outage.
Why this is correct
Insurance is a classic risk transfer mechanism that compensates for financial loss after an event. It does not alter the underlying likelihood or impact of the operational disruption, so restoration time and regulatory deadlines remained exposed. The committee effectively transferred only the monetary consequence, leaving the availability and compliance risks unmitigated, which is why the four-day outage still occurred.
- ✗
Risk mitigation, because the insurance policy reduced the likelihood of a ransomware attack.
Why it's wrong here
Risk mitigation reduces likelihood or impact through controls such as hardened backups, segmentation, or endpoint detection. An insurance policy does not prevent or interrupt a ransomware attack; it reimburses covered losses after the fact. The scenario shows the attack still succeeded and recovery took four days, demonstrating that no preventive or recovery capability was added through the insurance purchase.
- ✗
Risk avoidance, because the committee decided not to invest in additional backup controls.
Why it's wrong here
Risk avoidance means eliminating the activity or exposure entirely, such as discontinuing the core banking service or moving to a fully outsourced model with no retained processing. Here the organization continued operating the platform, so the risk was retained and partially transferred, not avoided. Declining to add controls is not the same as avoiding the risk, and the outage confirms the exposure remained active.
- ✗
Risk acceptance, because the committee acknowledged the residual risk without purchasing insurance.
Why it's wrong here
Risk acceptance means acknowledging the exposure and taking no action to transfer, mitigate, or avoid it. Because the committee purchased an insurance policy, they took an active step to shift financial consequences to a third party, which is transfer rather than acceptance. The scenario explicitly describes a transfer action, so acceptance mischaracterizes the response chosen and the resulting control gap.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 1,062 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.