CRISC IT Risk Assessment Practice Question
An organization is conducting a risk assessment and finds that the inherent risk for a critical asset is very high due to a high threat event frequency and high vulnerability. The current controls are assessed as adequate in design but not operating effectively. Which THREE of the following should be considered when calculating residual risk?
⚠ Common exam trap
It's easy for candidates to confuse risk appetite (E) as a direct input to residual risk calculation, when it is actually a threshold for evaluating residual risk, not a component of its calculation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Inherent risk score
Inherent risk score (A) is correct because residual risk is calculated by considering the inherent risk level and the effectiveness of controls in reducing that risk. Since the inherent risk is very high due to high threat frequency and vulnerability, this baseline score must be factored into the residual risk calculation to determine the remaining risk after controls are applied.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Inherent risk score
Why this is correct
Residual risk is based on inherent risk reduced by controls.
- ✓
Control design adequacy
Why this is correct
Design adequacy is part of control effectiveness assessment.
- ✗
Cost-benefit analysis of controls
Why it's wrong here
Cost-benefit analysis is used for prioritization, not directly in residual risk calculation.
- ✓
Control operating effectiveness
Why this is correct
Operating effectiveness is critical; if not effective, controls provide less reduction.
- ✗
Risk appetite statement
Why it's wrong here
Risk appetite determines whether residual risk is acceptable, but is not used in the calculation itself.
Go deeper
Related to this question
About these practice questions
One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.