CRISC Risk Response and Reporting Practice Question
An organization is implementing a risk-aware culture. Which TWO of the following are effective practices?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Encourage incident reporting without fear of blame.
Tone from top and incident reporting without blame are key to promoting a risk-aware culture. Security awareness training is also important, but the question asks for TWO practices, and these are most directly related to culture.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Conduct annual security awareness training only.
Why it's wrong here
While training is important, annual alone is insufficient; also, the question asks for TWO best practices, and this is not as directly cultural as tone and no-blame.
- ✓
Encourage incident reporting without fear of blame.
Why this is correct
Psychological safety promotes reporting, strengthening culture.
- ✗
Provide incentives for risk identification.
Why it's wrong here
Incentives can help, but the two most critical are tone from top and no-blame reporting.
- ✓
Tone from top: leadership demonstrates commitment to risk management.
Why this is correct
Leadership sets the example for risk awareness.
- ✗
Blame individuals for incidents to deter future occurrences.
Why it's wrong here
Blame discourages reporting, undermining culture.
Go deeper
Related to this question
About these practice questions
One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.