CRISC Risk Response and Mitigation Practice Question
A global manufacturing company is implementing a new ERP system across multiple regions. The project manager has identified a risk that data migration from legacy systems may cause data corruption, leading to production delays. The risk owner proposes conducting a full data reconciliation after migration. However, the IT director argues that this would be too time-consuming and suggests only sampling data for verification. The risk manager must decide on the risk response. The project timeline is tight, and the company has a low tolerance for data integrity issues. Which of the following is the BEST course of action?
⚠ Common exam trap
Many candidates choose data sampling (Option A) as a compromise to save time, overlooking that the company's low tolerance for data integrity issues demands full verification, not a statistical shortcut.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement the full data reconciliation as proposed by the risk owner
Full data reconciliation is the correct risk response because the company has a low tolerance for data integrity issues and the risk of data corruption could cause production delays. While time-consuming, this approach directly mitigates the identified risk by ensuring all migrated data is verified, aligning with the risk appetite. Sampling would leave a margin of error unacceptable for a low-tolerance environment, and the other options either fail to address the risk or are impractical.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Accept the risk and proceed with data sampling to save time
Why it's wrong here
Sampling verifies only a subset of migrated records, so corruption outside the sample passes undetected into production, conflicting with the company's low tolerance for data integrity issues. Acceptance is tempting because it preserves the tight timeline, and would be correct where impact is minor and tolerance high.
- ✗
Avoid the risk by postponing the ERP implementation
Why it's wrong here
Postponing the ERP implementation eliminates the migration risk entirely but halts a strategic multi-region programme, which is disproportionate when reconciliation and validation controls can reduce the corruption risk to within the stated low tolerance. Avoidance suits risks whose impact cannot be mitigated and whose activity is optional, not a mandated core system rollout.
- ✓
Implement the full data reconciliation as proposed by the risk owner
Why this is correct
Full reconciliation matches every migrated record against the legacy source, detecting all corruption rather than extrapolating from samples. Given the tight timeline but low tolerance for data integrity issues, this response aligns with the organisation's stated risk appetite and avoids production delays from undetected errors.
- ✗
Transfer the risk by purchasing insurance for data corruption
Why it's wrong here
Insurance compensates financial loss after corruption occurs; it neither prevents corrupted records entering the ERP nor addresses production delays, so the low tolerance for data integrity issues remains unmet. Transfer is tempting because it moves financial exposure to a third party, and suits risks where residual impact is purely monetary.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 1,062-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.