CRISC Risk Response and Reporting Practice Question
An organization's risk report shows a risk heat map with several risks in the high-likelihood, high-impact quadrant. What is the most appropriate action for the risk owner?
⚠ Common exam trap
CRISC often tests risk response discipline — candidates pick 'accept' or 'report' because they sound decisive, but high-high risks require control evaluation and treatment consideration, not passive acceptance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Evaluate current controls and consider additional treatment
Risks in the high-likelihood, high-impact quadrant exceed the organization's risk appetite and require active treatment. The risk owner should first evaluate the effectiveness of existing controls, then consider additional treatment options (mitigate, transfer, avoid, or accept with justification). Simply accepting or ignoring high-exposure risks is not defensible risk management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Report to the board without any analysis
Why it's wrong here
Escalating to the board without analysis gives directors no treatment options, owners, or residual-risk position, so no informed decision is possible. It is tempting because high-impact risks do warrant board visibility, and reporting would be correct once the risk owner has completed assessment and proposed a response for approval.
- ✗
Ignore the risks as they are inherent
Why it's wrong here
Inherent risk still requires treatment; ignoring it because it is inherent leaves exposure unmanaged and breaches the risk owner's accountability. It is tempting because inherent risk is a real concept, and ignoring would be defensible only after controls reduce it to residual levels within appetite, with monitoring in place.
- ✗
Accept the risk without further action
Why it's wrong here
Acceptance leaves high-likelihood, high-impact risks untreated, exceeding most tolerance thresholds and requiring documented justification and authority. It is tempting because acceptance is a legitimate response, and it would be correct for low-impact risks, or where treatment cost exceeds the potential loss and management formally approves the residual exposure.
- ✓
Evaluate current controls and consider additional treatment
Why this is correct
High-likelihood, high-impact risks sit above appetite, so the owner must assess whether existing controls actually reduce exposure, then decide on additional treatment such as mitigation, transfer or avoidance. Inaction leaves the residual risk unmanaged, breaching the stem's heat-map escalation.
Go deeper
Related to this question
About these practice questions
One of 1,062 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.