CRISC Risk Response and Reporting Practice Question
An organization wants to promote a risk-aware culture. Which of the following actions is MOST effective for encouraging employees to report incidents without fear?
⚠ Common exam trap
CRISC often tests the difference between technical controls and cultural enablers; candidates may mistakenly choose automated monitoring or training as the most effective, overlooking that fear of punishment is a human factor that only policy can address.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Establish a non-punitive incident reporting policy
A non-punitive incident reporting policy directly removes the fear of retaliation or blame, which is the primary barrier to reporting. By guaranteeing that employees will not be punished for reporting incidents (including their own mistakes), the organization encourages transparency and timely disclosure. This aligns with CRISC principles of fostering a risk-aware culture where risk information flows freely. Other options do not address the fear factor; rewards for zero incidents can actually discourage reporting, automated tools don't change human behavior, and annual training is insufficient to build trust.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reward employees for zero incidents
Why it's wrong here
Rewarding zero incidents incentivises staff to hide or under-report near misses, directly suppressing the reporting the culture depends on. It is tempting because incentives do shape behaviour and recognition programmes can reinforce desired conduct, and rewarding quality reporting rather than absence of incidents would be the correct application.
- ✓
Establish a non-punitive incident reporting policy
Why this is correct
A non-punitive policy removes the fear of blame or reprisal, which is the specific barrier stopping employees from reporting incidents. Awareness campaigns or training alone cannot overcome that fear, so this directly satisfies the stem's constraint of encouraging reporting without fear.
- ✗
Implement automated monitoring tools
Why it's wrong here
Automated monitoring detects events without human disclosure, so it cannot reduce employees' fear of reporting; surveillance can even suppress it. Monitoring is the right control for continuous detection and alerting, but the scenario requires a cultural mechanism that protects and reassures the reporter.
- ✗
Conduct security awareness training annually
Why it's wrong here
Annual training raises awareness but provides no anonymous, non-punitive reporting channel, so fear of blame persists. It is tempting because recurring awareness sessions do shape behaviour and satisfy compliance expectations, yet they address knowledge, not the psychological safety that encourages incident disclosure.
Go deeper
Related to this question
About these practice questions
One of 1,062 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.