CRISC IT Risk Assessment Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Avoidance of the business process

  Why it's wrong here

  Avoidance eliminates the activity generating the risk entirely, whereas acceptance retains the process and documents the exposure. Avoidance is tempting when risk exceeds appetite and no treatment is cost-effective, but here the risk already falls within appetite, so cancelling the business process is unnecessary and contradicts the owner's decision to accept.

• ✗

  Transfer of risk to an insurance provider

  Why it's wrong here

  Risk acceptance requires documented acknowledgement by the risk owner within appetite; transferring to an insurer is risk transfer, a distinct treatment that shifts financial impact via a contract. Insurance is tempting because it addresses residual risk, but it is chosen when impact exceeds appetite, not when the organisation formally accepts the exposure itself.

• ✓

  Formal sign-off by the risk owner

  Why this is correct

  Risk acceptance requires the risk owner to formally sign off, documenting accountability for the decision to tolerate the risk without added controls. This satisfies the requirement that acceptance be authorised at the appropriate level, since the risk falls within the stated risk appetite.

• ✗

  Implementation of compensating controls

  Why it's wrong here

  Acceptance means no additional controls are implemented; compensating controls constitute risk mitigation, a different treatment. They are tempting because they reduce exposure when primary controls cannot be applied, but the scenario explicitly states the risk sits within appetite and the owner accepts it without further action, so mitigation contradicts the chosen response.

Go deeper

Related to this question