CRISC IT Risk Assessment Practice Question
A risk practitioner is assessing the risk of a legacy application that supports a critical business process. The application vendor no longer provides security patches. The business cannot replace the application within the next 12 months due to budget constraints. Which of the following is the MOST appropriate risk treatment?
⚠ Common exam trap
The trap here is assuming that budget constraints force either full acceptance or avoidance, overlooking compensating controls and time-bound acceptance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement compensating controls such as network segmentation and enhanced monitoring, and document the risk with a time-bound acceptance
When a legacy application cannot be replaced immediately, the best treatment is to apply compensating controls to reduce risk while formally accepting the residual risk with a defined review period. This approach addresses the risk pragmatically and maintains alignment with business constraints and risk appetite.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Transfer the risk by purchasing cyber insurance and take no other action
Why it's wrong here
Insurance can transfer some financial impact, but it does not address the underlying vulnerability or reduce the likelihood of an incident. Relying solely on insurance for an unpatched critical application is insufficient because operational disruption and reputational damage may not be fully covered. Additional controls are still needed.
- ✗
Accept the risk without any additional controls because the business cannot afford to replace the application
Why it's wrong here
Accepting the risk without any compensating controls ignores the availability of measures that could reduce risk. Budget constraints do not justify taking no action if reasonable controls exist. This approach could leave the organization exposed to significant loss and does not demonstrate due diligence in risk treatment.
- ✓
Implement compensating controls such as network segmentation and enhanced monitoring, and document the risk with a time-bound acceptance
Why this is correct
Since the application cannot be replaced immediately, compensating controls can reduce the likelihood or impact of exploitation. Documenting the risk with a time-bound acceptance ensures it is formally acknowledged and reviewed. This is a pragmatic treatment that balances risk reduction with business constraints, and it aligns with risk management principles.
- ✗
Avoid the risk by immediately shutting down the legacy application
Why it's wrong here
Avoidance would eliminate the risk but also disrupt the critical business process it supports. Since the application cannot be replaced within 12 months, shutting it down is not feasible. Avoidance is not appropriate when the business impact of doing so is unacceptable.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 1,062-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.