CRISC IT Risk Assessment Practice Question
A risk manager is prioritizing risks based on their inherent risk scores. Which of the following factors should be considered when prioritizing treatment actions?
⚠ Common exam trap
CRISC often tests the misconception that the highest inherent risk always gets treated first — the trap is ignoring that cost-benefit analysis determines whether and how to treat.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The cost-benefit analysis of controls
When prioritizing treatment actions, the risk manager must weigh the cost of implementing controls against the benefit (risk reduction) they deliver. A high inherent risk may not justify an expensive control if the residual risk is already acceptable or the control cost exceeds the expected loss. Cost-benefit analysis ensures treatment is economically justified and resources are allocated where they reduce risk most efficiently.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The cost-benefit analysis of controls
Why this is correct
Prioritising treatment requires weighing each control's cost against the risk reduction it delivers, so inherent scores alone are insufficient. Cost-benefit analysis determines whether a treatment is justified, ensuring resources target risks where mitigation value exceeds expense.
- ✗
The residual risk after controls
Why it's wrong here
Residual risk reflects exposure remaining after existing controls, so it is the input for deciding whether further treatment is warranted, not a factor applied when prioritising inherent-risk-ranked items. It would be the correct basis once controls are in place and management wants to know what exposure actually remains.
- ✗
Only the inherent risk score
Why it's wrong here
Using only the inherent risk score ignores treatment cost, effort and the risk appetite threshold that determine which risks get addressed first. It is tempting because inherent scores are already calculated and ranked, but prioritisation requires comparing those scores against appetite and available resources, not reading the score alone.
- ✗
The likelihood of control failure
Why it's wrong here
Likelihood of control failure concerns control reliability during operation, not the business impact and likelihood that drive treatment priority for inherent risks. It is tempting because control weakness does affect residual exposure, but that belongs to control assessment, not to ranking inherent risks for treatment.
Go deeper
Related to this question
About these practice questions
One of 1,062 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.