hardMultiple ChoiceObjective-mapped
CRISC Practice Question: Uses a risk register that includes inherent risk,…
An organization uses a risk register that includes inherent risk, control effectiveness, and residual risk. During a quarterly review, the risk owner updates control effectiveness from 'partially effective' to 'effective'. What effect does this have on the residual risk rating?
⚠ Common exam trap
CRISC often tests the misconception that residual risk is static or that inherent risk changes with control improvements, but the key trap here is confusing inherent risk (which is independent of controls) with residual risk (which is dependent on control effectiveness).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Residual risk decreases
When control effectiveness is updated from 'partially effective' to 'effective', the control is now better at mitigating the inherent risk. Since residual risk is calculated as inherent risk minus the risk reduction provided by controls, improving control effectiveness directly lowers the residual risk rating. The risk register reflects this by showing a decreased residual risk value, assuming inherent risk remains unchanged.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Inherent risk changes
Why it's wrong here
Inherent risk is independent of controls.
- ✓
Residual risk decreases
Why this is correct
Better controls reduce residual risk.
- ✗
Residual risk increases
Why it's wrong here
Improved controls cannot increase residual risk.
- ✗
Residual risk remains unchanged
Why it's wrong here
Residual risk depends on control effectiveness.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 983-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.