mediumMultiple ChoiceObjective-mapped
CRISC Practice Question: A risk register is being updated after a…
A risk register is being updated after a quarterly risk assessment. One risk has decreased in likelihood due to new controls. However, the risk score remains unchanged because the impact increased. What should the risk practitioner do?
⚠ Common exam trap
Many candidates assume a decrease in likelihood automatically lowers the risk score, ignoring that a simultaneous increase in impact can offset that reduction, leading them to prematurely accept or escalate the risk without recalculating.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Recalculate the risk score using the new likelihood and impact values
The risk score is a function of both likelihood and impact. Even though new controls reduced likelihood, the increased impact means the overall risk level may remain unchanged. The correct action is to recalculate the risk score using the updated values to reflect the current risk posture accurately, as required by the risk assessment process.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Remove the risk from the register because it is under control
Why it's wrong here
The risk is still present; removal only after acceptance or transfer.
- ✓
Recalculate the risk score using the new likelihood and impact values
Why this is correct
The risk score should be based on current likelihood and impact; if impact increased, the score may stay the same or increase.
- ✗
Automatically accept the risk because likelihood decreased
Why it's wrong here
Acceptance requires evaluation of residual risk, not just likelihood.
- ✗
Escalate to senior management for a new risk treatment plan
Why it's wrong here
Escalation should occur if residual risk exceeds tolerance, not simply because score changed.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 983 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.