easyMultiple ChoiceObjective-mapped
CRISC Practice Question: A risk practitioner discovers that a critical…
A risk practitioner discovers that a critical control deficiency has been open for six months beyond the agreed remediation date. What is the MOST appropriate reporting action?
⚠ Common exam trap
Watch out — candidates often confuse the operational step of notifying the control owner (Option B) with the required reporting action, failing to recognize that after a six-month overdue period, the deficiency has already escalated in severity and must be reported to senior management for formal governance action.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Report the overdue deficiency to senior management for escalation.
A critical control deficiency that remains unresolved six months past its remediation date represents a significant governance failure and an elevated risk exposure that exceeds the organization's risk appetite. The risk practitioner's primary reporting obligation under CRISC principles is to escalate such overdue deficiencies to senior management, who have the authority and accountability to enforce remediation, allocate resources, or accept the risk formally. This aligns with the monitoring and reporting domain, where timely escalation of control failures is essential to maintain the integrity of the risk management process.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Report the overdue deficiency to senior management for escalation.
Why this is correct
Timely escalation is key for unresolved critical issues.
- ✗
Notify the control owner and request an updated remediation plan.
Why it's wrong here
Should have been done earlier; escalation is needed.
- ✗
Accept the delay and extend the remediation date by six months.
Why it's wrong here
Accepting without analysis ignores the risk.
- ✗
Update the risk register to reflect the increased residual risk and close out the deficiency.
Why it's wrong here
Closing without remediation is not acceptable.
Visual reference
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 983-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.