mediumMultiple SelectObjective-mapped
CRISC Practice Question: A risk analyst is reviewing the results of…
A risk analyst is reviewing the results of control testing for a critical business process. Which THREE of the following are valid reasons to classify a control as ineffective?
⚠ Common exam trap
A common mix-up: candidates confuse a single successful test result with proof of ongoing effectiveness, or mistake an administrative issue (owner unavailability) for a control deficiency, when in fact the control's design and execution are what matter.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The control was not executed as per procedure.
A control that is not executed as per its documented procedure indicates an operational failure. Even if the control design is sound, failure to follow the procedure means the control did not operate as intended, rendering it ineffective in mitigating the risk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The control was not executed as per procedure.
Why this is correct
Deviating from procedure compromises control effectiveness.
- ✓
The control failed during peak load testing.
Why this is correct
Failure under stress shows the control may not be reliable in real conditions.
- ✓
The control design does not address the risk.
Why this is correct
A design gap means the control cannot achieve its objective.
- ✗
The control was tested once and passed.
Why it's wrong here
A single pass indicates effectiveness, not ineffectiveness.
- ✗
The control owner was not available during the test.
Why it's wrong here
Owner absence does not affect the control's technical performance.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 983-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.