CRISC Risk Response and Reporting Practice Question
A multinational manufacturer has completed a quantitative risk analysis for a ransomware scenario affecting its primary ERP system. The analysis shows an annualized loss expectancy (ALE) of $2.4 million. A proposed endpoint detection and response (EDR) solution would cost $600,000 annually and is projected to reduce the ALE by 60%. The CFO asks the risk practitioner to justify the investment. Which of the following is the BEST response?
⚠ Common exam trap
The trap here is treating a large percentage risk reduction as sufficient justification without subtracting the control's annual cost from the avoided loss.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The EDR solution delivers a net risk reduction benefit of $840,000 annually, so it should be approved.
The control reduces the $2.4 million ALE by 60%, avoiding $1.44 million in expected annual loss, and costs $600,000 per year. The net benefit of $840,000 is positive, so the investment is economically justified. The other responses either invoke unsupported benchmarks, assume an unstated appetite threshold, or rely on the percentage reduction without considering cost.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The EDR solution should be approved because any control that reduces risk by more than half automatically satisfies the cost-benefit test.
Why it's wrong here
A percentage reduction alone says nothing about cost; an expensive control could reduce risk by 60% yet cost more than the loss avoided. The cost-benefit test requires comparing the monetized risk reduction against the control's annual cost. This reasoning is logically incomplete and would not satisfy the CFO's request for justification.
- ✓
The EDR solution delivers a net risk reduction benefit of $840,000 annually, so it should be approved.
Why this is correct
A 60% reduction of the $2.4 million ALE equals $1.44 million in avoided loss. Subtracting the $600,000 annual cost yields a net benefit of $840,000, which is positive and therefore economically justified. This quantitative comparison directly answers the CFO's request for justification and supports approval.
- ✗
The EDR solution costs 25% of the ALE, which is within the accepted industry benchmark for control spending.
Why it's wrong here
There is no universal benchmark stating that a control should cost a fixed percentage of ALE; citing one without evidence is unsupported. The relevant test is whether avoided loss exceeds control cost, not whether the cost ratio matches a claimed norm. This response would not withstand CFO scrutiny because it substitutes an assertion for the actual cost-benefit calculation.
- ✗
The EDR solution should be rejected because the residual ALE of $960,000 remains above the organization's risk appetite.
Why it's wrong here
Rejection could be valid only if the residual exceeded a stated appetite threshold and no better option existed, but the scenario never states an appetite figure. The 60% reduction produces a substantial net benefit, which supports approval. This option invents a condition not present in the scenario and reaches the opposite conclusion from the correct financial analysis.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 1,062-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.