CRISC Risk Response and Reporting Practice Question
An organization is implementing a new control to address a high-risk finding. The project manager has scheduled a user training session and updated the relevant policies. Which implementation phase is being addressed?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Control implementation
These activities (training and documentation updates) are part of the control implementation phase, specifically after the control is designed and before going live.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Control monitoring
Why it's wrong here
Monitoring verifies control operation after deployment through testing and metrics. Scheduling training and updating policies are deployment activities, not ongoing oversight. Monitoring would be correct once the control runs and its effectiveness must be measured against the risk.
- ✗
Risk assessment
Why it's wrong here
Risk assessment identifies and evaluates risk before controls are selected. Training and policy updates happen after a control is chosen and being deployed. Risk assessment would be the right phase when determining likelihood and impact of the finding, not when operationalising the response.
- ✓
Control implementation
Why this is correct
Training and policy updates are execution activities, not design or assessment. Control implementation covers deploying the approved control into operation, which includes enabling people and processes through training and revised policies. This satisfies the stem's requirement to identify the phase where the control is actually put in place.
- ✗
Control design
Why it's wrong here
Training and policy updates occur during implementation and rollout, not design. Control design defines the control's structure, type and placement before deployment. It would be the right phase when specifying how the control operates, not when preparing staff and procedures for go-live.
Go deeper
Related to this question
About these practice questions
One of 1,062 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.