CRISC Risk Response and Mitigation Practice Question
After implementing security controls, a risk assessment shows a residual risk of data exfiltration with a probability of 5% and potential loss of $10 million. The organization's risk appetite allows a maximum acceptable risk level of 3% probability for such impact. The cost of further mitigation is $1 million. What is the best risk response?
⚠ Common exam trap
The trap here is that candidates focus on the cost-benefit analysis (mitigation cost vs. reduced expected loss) and incorrectly conclude that acceptance is cheaper, ignoring that risk appetite is a binding constraint that overrides pure financial calculations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement additional controls to reduce probability to 2%
The residual risk has a probability of 5% and a potential loss of $10 million, resulting in an expected loss of $500,000. The organization's risk appetite allows a maximum probability of 3% for such an impact, so the current risk exceeds the acceptable threshold. Implementing additional controls for $1 million to reduce the probability to 2% brings the risk within the risk appetite (expected loss of $200,000) and is cost-effective because the reduction in expected loss ($300,000) is less than the control cost, but the primary driver is compliance with risk appetite, not pure cost-benefit.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Implement additional controls to reduce probability to 2%
Why this is correct
Further mitigation brings risk within appetite.
- ✗
Accept the residual risk
Why it's wrong here
Risk exceeds appetite.
- ✗
Purchase cybersecurity insurance
Why it's wrong here
Insurance reduces impact but does not lower probability below appetite threshold.
- ✗
Discontinue the process
Why it's wrong here
Avoidance is not necessary if mitigation is feasible.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 983-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.