CRISC Risk Response and Reporting Practice Question
A risk manager is evaluating the cost-effectiveness of a proposed control. The control costs $50,000 annually to implement and maintain. The current annual loss expectancy (ALE) for the risk is $200,000, and the control is expected to reduce the ALE by 70%. What is the net benefit (or loss) of implementing the control?
⚠ Common exam trap
CRISC often tests whether candidates confuse gross savings with net benefit — the most common error is selecting the $140,000 figure by forgetting to subtract the control's annual cost, or misreading the 70% as applying to the cost rather than the ALE.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Net benefit of $90,000
The control reduces the ALE by 70%, so the mitigated ALE is $200,000 × 0.30 = $60,000, meaning the control saves $140,000 in expected annual loss. Subtracting the $50,000 annual control cost gives a net benefit of $140,000 − $50,000 = $90,000. This is the standard ALE-based cost-benefit calculation used in CRISC risk treatment decisions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Net benefit of $90,000
Why this is correct
The control reduces ALE by 70% of $200,000, giving a $140,000 mitigated loss. Subtracting the $50,000 annual control cost yields a $90,000 net benefit. This satisfies the stem's cost-effectiveness comparison between control spend and risk reduction.
- ✗
Net loss of $10,000
Why it's wrong here
A $10,000 loss misstates the arithmetic: the control saves $140,000 against a $50,000 cost, giving a $90,000 net benefit. It is tempting because it looks like a small residual figure after subtracting the control cost, and it would be correct if the control only reduced the ALE by 30 per cent.
- ✗
Net benefit of $140,000
Why it's wrong here
$140,000 is the mitigated loss reduction, not the net benefit; the $50,000 control cost must be deducted, giving $90,000. It is tempting because it correctly computes 70 per cent of $200,000, and it would be the right figure if the question asked for the value of the risk reduction alone.
- ✗
Net loss of $50,000
Why it's wrong here
A $50,000 loss simply repeats the control's annual cost without applying the 70 per cent ALE reduction. It is tempting because it treats the control as pure expense, and it would be correct if the control delivered no risk reduction at all, leaving the full ALE unmitigated.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 1,062 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.