CRISC Risk Response and Reporting Practice Question
An organization's risk register lists a risk with an annualized loss expectancy (ALE) of $200,000. A proposed control would reduce the ALE to $50,000, and the control costs $40,000 per year to operate. What is the value of the control's risk reduction?
⚠ Common exam trap
Candidates often confuse the control's operating cost or net benefit with the risk reduction value, when the risk reduction is strictly the drop in expected annual loss before and after the control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
$150,000
The value of the risk reduction is the difference between the original ALE and the residual ALE after the control is applied. Here, $200,000 minus $50,000 equals $150,000. This figure represents the expected annual loss avoided. Comparing it to the $40,000 annual control cost yields a net benefit of $110,000, indicating the control is cost-effective.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
$10,000
Why it's wrong here
This figure represents the net benefit after subtracting the control cost from the risk reduction, but the question asks for the value of the risk reduction, not the net benefit. The risk reduction is the difference between the original ALE and the residual ALE, which is $150,000. The $10,000 figure is not the risk reduction value.
- ✗
$200,000
Why it's wrong here
This is the original ALE before the control is applied, representing the total expected annual loss if no action is taken. It does not account for the reduction provided by the control. The value of the risk reduction must reflect the decrease in expected loss, which is the difference between the original and residual ALE.
- ✓
$150,000
Why this is correct
The value of the risk reduction is the original ALE minus the residual ALE: $200,000 - $50,000 = $150,000. This represents the expected annual loss avoided by implementing the control. Comparing this to the $40,000 annual control cost shows a positive net benefit, making the control economically justified from a quantitative standpoint.
- ✗
$40,000
Why it's wrong here
This is the annual cost of operating the control, not the value of the risk reduction. While cost is a critical input to the cost-benefit analysis, it does not represent the reduction in expected loss. The risk reduction is calculated by comparing the ALE before and after the control is implemented, which yields a different figure.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 1,062 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.