CRISC IT Risk Assessment Practice Question
During an IT risk assessment, the risk practitioner calculates the inherent risk score for a critical application as 25 (on a 5×5 matrix). After evaluating control effectiveness, the residual risk score is 9. What can be inferred about the controls?
⚠ Common exam trap
CRISC often tests the misconception that any remaining residual risk means controls are ineffective, when in fact residual risk is expected and its reduction ratio indicates effectiveness.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Controls are effective in reducing the risk level
Inherent risk of 25 (5×5 matrix, maximum) dropping to residual risk of 9 after control evaluation demonstrates that the controls materially reduced the risk exposure. A reduction from 25 to 9 is significant, indicating the controls are functioning as intended to mitigate the identified threat. This is the standard interpretation in CRISC risk analysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Controls are effective in reducing the risk level
Why this is correct
Residual risk of 9 is substantially lower than the inherent risk of 25, showing the controls reduced exposure. This drop demonstrates the controls are effective, as residual risk reflects remaining risk after control effectiveness is applied to inherent risk.
- ✗
Additional controls are unnecessary
Why it's wrong here
A drop from inherent 25 to residual 9 shows controls reduce risk substantially but not to zero; residual risk remains and must be accepted, transferred or mitigated further. It is tempting to read low residual as adequate, yet the score itself does not prove additional controls are unnecessary.
- ✗
Controls are not effective because residual risk remains
Why it's wrong here
A residual of 9 against an inherent 25 demonstrates the controls reduced risk, so they are partially effective. It tempts because any residual risk can be read as failure, but residual risk is what remains after controls, and it is never expected to reach zero.
- ✗
The inherent risk was overestimated
Why it's wrong here
A drop from 25 to 9 reflects control effectiveness reducing likelihood or impact, not an error in the inherent score. It tempts because a large reduction can look like overestimation, but inherent risk is assessed before controls by definition, so the two figures measure different things.
Go deeper
Related to this question
About these practice questions
One of 1,062 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.