CRISC IT Risk Identification Practice Question
An organization has a risk appetite statement that says 'We accept up to $5 million in operational losses per year.' However, a new cloud migration project is estimated to have a potential operational loss of $8 million if a critical failure occurs. The risk capacity of the organization is $20 million. What should the risk practitioner recommend?
⚠ Common exam trap
CRISC often tests the distinction between risk appetite and risk capacity, and candidates may incorrectly choose to accept the risk because it is within capacity, or reject the project without considering risk treatment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement risk treatment measures to reduce the potential loss to below $5 million
The risk appetite statement sets a clear threshold of $5 million in acceptable operational losses per year. The project's potential loss of $8 million exceeds this appetite, so the risk practitioner should recommend risk treatment measures to bring the potential loss within the appetite. This aligns with the risk management principle of modifying risk to align with organizational risk tolerance before accepting or rejecting a project outright.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reject the project because the risk exceeds the risk appetite
Why it's wrong here
Risk appetite is a tolerance threshold, not a hard project veto; the $8 million loss sits within the $20 million risk capacity, so the practitioner should recommend risk treatment or escalation rather than rejection. Rejection is tempting when appetite is misread as an absolute ceiling, which suits cases where capacity itself is breached.
- ✓
Implement risk treatment measures to reduce the potential loss to below $5 million
Why this is correct
The $8 million exposure breaches the stated $5 million risk appetite, though it remains within the $20 million risk capacity. Treatment is required to bring the loss below the appetite threshold; merely accepting it would exceed the tolerance the organisation has formally set.
- ✗
Increase the risk appetite to $8 million to align with the project
Why it's wrong here
Risk appetite is a board-approved boundary expressing acceptable loss, not a figure adjusted to accommodate a project; raising it to $8 million inverts governance by letting the initiative redefine tolerance. It tempts because aligning stated limits with actual exposure appears pragmatic, and revising appetite is correct only through formal board review, not project-driven amendment.
- ✗
Accept the risk because the risk capacity is $20 million
Why it's wrong here
Risk capacity is the absolute maximum loss the organisation could absorb, not a threshold for accepting exposures; the $8 million loss still breaches the $5 million appetite, so acceptance without treatment is unjustified. It tempts because capacity exceeds the loss, and accepting risk is correct when exposure falls within the approved appetite.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 1,062-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.