Risk Response and Reporting →mediumMultiple Choice

CRISC Risk Response and Reporting Practice Question

A financial services firm maintains a risk register that lists inherent risk ratings for its core banking platform. During an internal audit, the CIO notes that the register has not been updated to reflect the controls implemented over the past 18 months. Which of the following should the risk practitioner do FIRST to address this gap?

⚠ Common exam trap

The trap here is assuming the register is wrong because risks were never identified, when the actual gap is that implemented controls were never reflected in the residual ratings.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Reassess the residual risk for each entry by evaluating the effectiveness of the implemented controls.

The register captured inherent risk but never reflected the controls deployed over 18 months, so the residual risk position is stale. The practitioner must evaluate control effectiveness and recalculate residual risk for each affected entry. Escalation, deletion, or relabeling do not correct the data and would leave decision-makers with a misleading view of the firm's actual risk exposure.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Remove the affected entries from the register until a complete enterprise risk assessment can be scheduled.
Why it's wrong here
Deleting entries destroys the risk history and creates a false impression that the risks no longer exist. It also violates the principle that risks remain on the register until formally accepted, mitigated, or transferred. This action would worsen the audit finding rather than correct the underlying data quality issue.
✗
Reclassify all entries from inherent to residual risk so the register aligns with the audit terminology.
Why it's wrong here
Simply relabeling entries does not evaluate whether the controls actually reduce risk, so the ratings would still be inaccurate. Inherent and residual risk are distinct concepts, and mislabeling them corrupts the risk data. This is a cosmetic change that fails to address the substantive gap identified by the CIO.
✓
Reassess the residual risk for each entry by evaluating the effectiveness of the implemented controls.
Why this is correct
The register reflects inherent risk but ignores control effectiveness, so the residual risk is misstated. Reassessing residual risk by evaluating the controls already implemented directly corrects the outdated ratings and restores the register's accuracy. This is the logical first step because the identified gap is precisely the failure to reflect controls in the risk position.
✗
Escalate the finding to the board risk committee and request additional budget for a full risk assessment.
Why it's wrong here
Escalation may eventually be warranted, but it does not fix the register and skips the assessment work the practitioner can perform. Requesting budget for a full reassessment is disproportionate when the specific deficiency is known and scoped. The scenario asks for the first action to address the gap, which is the technical reassessment, not governance escalation.

Go deeper

CRISC Risk Response and Reporting Practice Question

Why each option matters

Option-by-option breakdown

Related to this question