CRISC Risk Response and Reporting Practice Question
An IT risk analyst is preparing a report for the board risk committee. The committee wants a single view of how much loss the organization could face from IT risks over the next year if no additional controls are implemented. Which metric should the analyst use?
⚠ Common exam trap
Many candidates confuse a control performance indicator, such as deficiency rate, with a quantified loss exposure metric such as ALE.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Annualized loss expectancy (ALE)
The board requested a single monetary view of potential annual loss from IT risks with no additional controls, which is precisely what annualized loss expectancy provides. ROSI is a control-investment metric, control deficiency rate measures control performance, and RTO is a time-based recovery target. Only ALE combines likelihood and financial impact into an expected annual loss figure suitable for board-level risk reporting.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Annualized loss expectancy (ALE)
Why this is correct
ALE expresses the expected annual monetary loss from a risk and is calculated as single loss expectancy multiplied by annualized rate of occurrence. It gives the board a forward-looking, quantified view of potential loss exposure before additional controls, which is exactly what the committee requested. It is the standard metric for comparing and prioritizing IT risks in financial terms.
- ✗
Return on security investment (ROSI)
Why it's wrong here
ROSI measures the financial benefit of a security control relative to its cost, not the gross loss exposure the organization faces. It is used to justify or compare investments after a control is proposed. The committee asked for potential loss if no additional controls are implemented, so a metric that depends on control cost and mitigation benefit does not answer the question.
- ✗
Recovery time objective (RTO)
Why it's wrong here
RTO defines the maximum acceptable time to restore a system or process after disruption. It is a business continuity parameter and is measured in time, not currency. While RTO influences impact estimates, it does not itself express expected annual loss, so it cannot provide the board with the aggregated financial exposure view they asked for.
- ✗
Control deficiency rate
Why it's wrong here
Control deficiency rate is the proportion of tested controls that failed to operate effectively. It is an indicator of control performance, not of potential financial loss. A high deficiency rate may signal elevated risk, but it does not quantify the monetary exposure the board requested, and it says nothing about inherent risk before additional controls.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 1,062-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.