CRISC Risk Response and Mitigation Practice Question
A risk manager is reviewing the organization's risk treatment plan for a critical web application. The plan includes implementing a web application firewall (WAF), conducting regular penetration tests, and purchasing cyber insurance. The risk manager notes that the residual risk after these treatments is still above the risk appetite. According to CRISC, what should the risk manager do NEXT?
⚠ Common exam trap
The trap here is assuming the risk manager should automatically implement more controls, but without management's risk tolerance decision, that could be inappropriate or wasteful.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Escalate the residual risk to senior management for a decision on whether to accept, further treat, or avoid the risk.
When residual risk exceeds the organization's risk appetite, it must be escalated to senior management, who are responsible for making risk-based decisions. They may choose to accept the risk, allocate resources for further mitigation, or avoid the activity. The risk manager's role is to inform and recommend, not to unilaterally decide or simply monitor.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reassess the risk to ensure the risk assessment is accurate and adjust the risk score accordingly.
Why it's wrong here
Reassessment might be warranted if there is doubt about the accuracy, but the scenario does not indicate that the assessment is flawed. The risk manager already knows residual risk is above appetite. The priority is to escalate for a risk response decision, not to redo the assessment, which could delay necessary action.
- ✗
Update the risk register to reflect the residual risk and continue monitoring.
Why it's wrong here
Updating the risk register is important, but it does not address the fact that residual risk exceeds appetite. Monitoring alone is insufficient when risk is outside tolerance; action or escalation is required. This option would leave the organization exposed to unacceptable risk without a decision from those with authority to accept it.
- ✗
Implement additional controls immediately to reduce the residual risk to an acceptable level.
Why it's wrong here
While implementing additional controls may be a valid response, it is not the immediate next step. The risk manager should first escalate the situation to senior management because they may have different risk tolerance or may decide to accept the risk. Taking unilateral action without management approval could lead to misalignment with business objectives and unnecessary costs.
- ✓
Escalate the residual risk to senior management for a decision on whether to accept, further treat, or avoid the risk.
Why this is correct
When residual risk exceeds the risk appetite, it is outside the organization's tolerance. The risk manager should escalate to senior management, who have the authority to decide on further risk response, such as accepting the risk, implementing additional controls, or discontinuing the activity. This aligns with CRISC's emphasis on risk governance and ensuring risk is managed within appetite.
Go deeper
Related to this question
About these practice questions
One of 1,062 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.