CRISC IT Risk Assessment Practice Question
During an IT risk assessment, the risk practitioner calculates the inherent risk score for a critical application as 25 (on a 5×5 matrix). After evaluating control effectiveness, the residual risk score is 9. What can be inferred about the controls?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Controls are effective in reducing the risk level
A reduction from 25 to 9 indicates controls are effective in reducing risk. High inherent risk does not automatically mean high residual risk; controls can reduce it significantly.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Controls are effective in reducing the risk level
Why this is correct
Significant reduction from 25 to 9 indicates effective controls.
- ✗
Additional controls are unnecessary
Why it's wrong here
Residual risk of 9 may still be above appetite; need for controls depends on risk appetite.
- ✗
Controls are not effective because residual risk remains
Why it's wrong here
Residual risk is expected; reduction shows effectiveness.
- ✗
The inherent risk was overestimated
Why it's wrong here
Inherent risk is assessed without controls; control effectiveness reduces it.
Go deeper
Related to this question
About these practice questions
One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.