CRISC Risk Response and Reporting Practice Question
During a control implementation project, the risk manager discovers that the resource requirements have increased significantly, making the original cost-benefit analysis invalid. What should the risk manager do first?
⚠ Common exam trap
CRISC often tests the instinct to escalate or cancel when costs change — the correct first step is always to gather updated information (revised cost-benefit analysis) before making a governance decision.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Perform a revised cost-benefit analysis
When resource requirements change enough to invalidate the original cost-benefit analysis, the risk manager's first step is to perform a revised cost-benefit analysis to reassess whether the control is still justified relative to the risk it mitigates. This provides the objective data needed before any decision to continue, escalate, or cancel. CRISC emphasizes that risk decisions must be based on current, accurate information rather than assumptions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Continue the project and request additional budget later
Why it's wrong here
Accepting an invalid cost-benefit analysis bypasses the risk response decision, so spend continues without approved justification. Requesting budget later presumes the project still merits funding. The risk manager should instead reassess the risk and re-perform the cost-benefit analysis, escalating for a formal go/no-go decision.
- ✗
Escalate to the board for approval of additional funds
Why it's wrong here
Escalating to the board presumes additional funding is the answer before the revised cost-benefit analysis exists; governance needs the updated business case first. Board escalation is appropriate once analysis confirms the control remains justified and funding exceeds the risk manager's authority.
- ✗
Cancel the project immediately
Why it's wrong here
Cancelling discards the control's risk-reduction value before any reassessment; the invalid cost-benefit analysis must first be revised with updated resource figures and residual risk. Cancellation is defensible only once revised analysis shows costs outweigh the risk being mitigated.
- ✓
Perform a revised cost-benefit analysis
Why this is correct
Revised resource requirements invalidate the original cost-benefit analysis, so recalculating costs against expected benefits restores the basis for a go/no-go decision. Performing this revised analysis first gives management accurate figures before any scope, budget or approval changes are considered.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 1,062-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.