CRISC Risk Response and Mitigation Practice Question
A healthcare organization's risk register shows that a critical server lacks vendor support and has a high inherent risk of failure. The risk owner proposes to implement redundant hardware and a failover cluster. The cost of the redundancy is $200,000, while the estimated annual loss from failure is $150,000. Which factor is MOST important for the risk practitioner to consider when evaluating this proposed risk response?
⚠ Common exam trap
The trap here is focusing on residual risk or likelihood without performing the cost-benefit calculation that reveals the control is more expensive than the potential loss.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The cost of the control compared to the expected loss
The risk practitioner must perform a cost-benefit analysis. The proposed control costs $200,000, while the expected annual loss is $150,000, meaning the control costs more than the risk it mitigates. Unless there are intangible or regulatory factors, the response is not cost-effective. The most important factor is the comparison of control cost to expected loss, which guides whether to mitigate, accept, or seek a cheaper alternative.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The likelihood of the server failing in the next year
Why it's wrong here
Likelihood is already factored into the expected annual loss of $150,000. Re-evaluating likelihood without considering the control cost would not help determine if the response is appropriate. The key issue is that the mitigation cost exceeds the expected loss, making the response economically inefficient regardless of the exact likelihood.
- ✓
The cost of the control compared to the expected loss
Why this is correct
The fundamental principle of risk response is that the cost of mitigation should not exceed the expected loss. Here, the control costs $200,000 annually while the expected loss is $150,000, indicating a negative return on security investment. The risk practitioner should recommend a more cost-effective solution or consider risk acceptance, as the proposed redundancy is not economically justified based on the given figures.
- ✗
The risk tolerance of the IT department
Why it's wrong here
Risk tolerance is an important consideration, but it is subjective and secondary to quantitative cost-benefit analysis. The IT department's tolerance does not override the economic reality that the control costs more than the expected loss. While tolerance may influence the final decision, the most critical factor is whether the mitigation is financially sound.
- ✗
The residual risk after implementing the redundancy
Why it's wrong here
Residual risk is important, but the question asks for the most important factor when evaluating the proposed response. The cost-benefit analysis is more critical here because the annual loss ($150,000) is less than the control cost ($200,000), making the mitigation economically unjustifiable unless other factors exist. Residual risk alone does not address the financial viability of the control.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 1,062 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.