CRISC Risk Response and Reporting Practice Question
A risk practitioner has completed a risk assessment for a new cloud-based payroll platform. The business owner wants to proceed immediately because the platform will save $200,000 annually. The residual risk exceeds the organization's risk appetite, and no compensating controls are in place. Which action should the risk practitioner recommend FIRST?
⚠ Common exam trap
The trap here is assuming that a strong business case justifies accepting risk that already exceeds the stated risk appetite.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Escalate the risk to the appropriate risk owner for a formal risk response decision.
Residual risk above appetite requires a formal decision by the risk owner, not by the practitioner or the business sponsor. Escalation ensures the accountable party evaluates response options and either approves mitigation, transfers the risk, avoids the initiative, or grants a documented exception. Simply accepting, controlling, or logging the risk would bypass the governance process that defines who may decide.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Escalate the risk to the appropriate risk owner for a formal risk response decision.
Why this is correct
When residual risk exceeds appetite, the practitioner's role is to escalate to the accountable risk owner, who has authority to select avoid, mitigate, transfer, or accept. Escalation preserves governance and ensures the decision is made at the correct level with full visibility of the gap between assessed risk and tolerance, rather than being decided informally by the practitioner or project team.
- ✗
Accept the risk because the financial benefit outweighs the potential loss.
Why it's wrong here
Acceptance is only valid when residual risk falls within the defined risk appetite or when the risk owner formally approves an exception. Here the residual risk explicitly exceeds appetite and no compensating controls exist, so accepting it would bypass governance and expose the organization to losses it has already declared unacceptable. Financial benefit alone does not authorize acceptance.
- ✗
Document the risk in the risk register and take no further action.
Why it's wrong here
Recording the risk is necessary but not sufficient. A risk register entry with no escalation or response decision leaves an out-of-appetite risk unmanaged and unowned. The practitioner must actively route the risk to the accountable owner so a deliberate response is selected, because documentation alone does not reduce exposure or satisfy risk governance obligations.
- ✗
Implement additional controls immediately and then inform the business owner.
Why it's wrong here
Controls are selected only after the risk owner chooses a mitigation response and approves the associated cost and effort. Unilaterally deploying controls could duplicate or conflict with existing measures, consume budget without authorization, and create a false sense that the risk has been formally treated, while leaving the underlying risk acceptance decision undocumented.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 1,062 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.