hardMultiple ChoiceObjective-mapped
CRISC Practice Question: A risk committee receives a monthly risk report…
A risk committee receives a monthly risk report that includes a heat map of inherent risk ratings and a separate list of control deficiencies. The committee members often complain that they cannot easily see which control deficiencies are most critical to address. Which of the following is the BEST improvement to the reporting?
⚠ Common exam trap
Watch out — candidates often choose a timeline or audit findings list (options B or D) thinking that age or audit source indicates criticality, but the question specifically asks for the BEST improvement to show which deficiencies are most critical to address, which requires a direct mapping to residual risk impact, not just additional data points.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Overlay control deficiency impact ratings onto the residual risk heat map
Overlaying control deficiency impact ratings onto the residual risk heat map directly addresses the committee's need to see which control deficiencies are most critical. This integrates control deficiency severity with residual risk levels, allowing the committee to prioritize remediation based on the actual risk exposure, not just inherent risk or a separate list.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Include a comprehensive list of all key risk indicators (KRIs)
Why it's wrong here
Additional KRIs could cause information overload without linking to control deficiencies.
- ✗
Provide a separate section on recent audit findings
Why it's wrong here
Audit findings are useful but do not directly show the impact on current risk.
- ✓
Overlay control deficiency impact ratings onto the residual risk heat map
Why this is correct
This visualization directly links control weaknesses to resulting risk levels, aiding prioritization.
- ✗
Add a timeline of when each control deficiency was first identified
Why it's wrong here
Timeline is informative but does not prioritize by criticality.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 983 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.