mediumMultiple ChoiceObjective-mapped
CRISC Practice Question: A medium-sized e-commerce company has a risk…
A medium-sized e-commerce company has a risk monitoring program that tracks key risk indicators (KRIs) monthly. One KRI is the percentage of orders with failed payment transactions. The threshold is 2%, but for the past three months, the KRI has been 2.5%, 3.1%, and 2.8%. The risk owner says this is due to a seasonal increase in fraudulent transactions and expects it to return to normal next month. The company has a compensating control that manually reviews flagged transactions. The internal audit team recently tested the compensating control and found it to be 100% effective. The risk committee wants to know if the KRI breach requires action. What should the risk practitioner recommend?
⚠ Common exam trap
A common mix-up: candidates assume any KRI breach automatically requires immediate remediation or escalation, ignoring the critical role of compensating controls in reducing residual risk to an acceptable level.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Acknowledge the breach but note that the compensating control is effective, so no immediate action is required; continue to monitor.
The compensating control (manual review of flagged transactions) has been tested as 100% effective, meaning the residual risk is within acceptable tolerance despite the KRI breach. The risk owner attributes the breach to a seasonal spike, and the risk monitoring program should continue to track the KRI monthly to confirm a return to normal. Immediate action is not warranted when the compensating control fully mitigates the risk, and the risk committee should be informed that the control is effective.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Immediately implement additional automated controls to reduce the KRI.
Why it's wrong here
Not needed if compensating control is effective.
- ✗
Escalate the issue to the board and recommend a risk acceptance.
Why it's wrong here
Unnecessary given effective compensating control.
- ✓
Acknowledge the breach but note that the compensating control is effective, so no immediate action is required; continue to monitor.
Why this is correct
Appropriate response given the circumstances.
- ✗
Lower the KRI threshold to 3% to accommodate seasonal variations.
Why it's wrong here
Changing threshold without analysis is not best practice.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 983 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.