CRISC Risk Response and Mitigation Practice Question
A multinational corporation has adopted a risk mitigation strategy for its key suppliers by requiring them to maintain ISO 27001 certification. During an audit, the risk manager discovers that one critical supplier lost its certification six months ago but did not report it, as contractually required. The supplier still has adequate security controls in place, and the relationship is strategically important. The CEO wants to avoid contract termination. What is the MOST appropriate risk response?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Issue a corrective action plan requiring the supplier to regain certification within three months, with monthly progress reviews.
It directly addresses the contractual breach with a corrective action plan and progress reviews, allowing the supplier to regain certification while maintaining the strategic relationship. Option B is incorrect because transferring risk to the supplier's cyber liability insurance does not restore the required certification or address the root cause of the breach. Option C is incorrect because accepting the risk disregards the contractual requirement for certification, even if controls are currently adequate. Option D is incorrect because immediate termination may be too disruptive given the strategic importance of the supplier and the existence of a feasible remediation path.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Issue a corrective action plan requiring the supplier to regain certification within three months, with monthly progress reviews.
Why this is correct
This enforces the contract and restores the intended risk mitigation.
- ✗
Transfer the risk to the supplier's cyber liability insurance policy.
Why it's wrong here
Insurance does not replace the need for certification or address the root cause.
- ✗
Accept the risk because the supplier still has effective controls, and update the risk register.
Why it's wrong here
Acceptance ignores the contractual breach and weakens the risk posture.
- ✗
Terminate the contract immediately and find an alternative supplier.
Why it's wrong here
Termination is disruptive and may not be necessary if the supplier can remediate.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 983-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.