CRISC Risk Response and Reporting Practice Question
An organization's risk register shows that a critical database containing customer records has a high inherent risk rating. Management installs database activity monitoring, enforces encryption at rest, and implements quarterly access reviews. After these actions, the risk is re-rated as medium. Which risk concept does the re-rated medium value BEST represent?
⚠ Common exam trap
The trap here is reading a post-control rating as inherent risk or as a statement of risk appetite rather than as residual risk.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Residual risk
Residual risk is the exposure that remains after controls are applied, and it is the figure decision makers should compare against tolerance. The database started with a high inherent rating; monitoring, encryption, and periodic access reviews lowered the likelihood and impact, producing a medium residual rating. Reporting residual risk keeps the risk register meaningful and prevents the organization from funding controls for exposure that has already been mitigated.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Risk appetite
Why it's wrong here
Risk appetite is the amount and type of risk an organization is willing to pursue or retain in pursuit of objectives. It is a governance statement, not a computed rating for a specific asset. The medium value here is an assessment outcome for the database risk, not a declaration of how much risk the firm will accept. Treating appetite as a rating blurs the line between tolerance-setting and risk measurement.
- ✗
Control risk
Why it's wrong here
Control risk refers to the possibility that controls fail to prevent or detect a risk event, sometimes used in audit contexts. The scenario does not describe a control breakdown; it describes a reduced rating after controls were successfully applied. Labeling the medium value as control risk would wrongly imply the controls themselves are deficient, which could trigger unnecessary remediation and misreport the actual exposure to the risk committee.
- ✓
Residual risk
Why this is correct
Residual risk is what remains after controls are designed and operating. Installing database activity monitoring, encryption at rest, and quarterly access reviews reduced the likelihood and impact of the identified threat, so the re-rated medium value reflects the remaining exposure. CRISC practitioners use residual risk, not inherent risk, to judge whether the response brings the risk within the organization's stated tolerance.
- ✗
Inherent risk
Why it's wrong here
Inherent risk is the level of risk before any controls are applied, which in this scenario was the original high rating. The question describes the rating after encryption, monitoring, and access reviews were implemented, so the medium value cannot be the inherent risk. Confusing the two leads to overstating exposure in reports and misallocating remediation budget to areas already well controlled.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 1,062 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.