easyMultiple ChoiceObjective-mapped
CRISC Practice Question: Is the BEST indicator that a control is effective…
Which of the following is the BEST indicator that a control is effective in mitigating a risk?
⚠ Common exam trap
Many candidates confuse control attributes (automation, documentation, cost) with direct evidence of effectiveness, but only regular testing provides the empirical proof that the control is actually reducing risk to the desired level.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Regular testing shows the control consistently reduces the risk to the desired level
The effectiveness of a control is ultimately measured by its ability to consistently reduce residual risk to the organization's defined risk appetite. Regular testing provides empirical evidence that the control is operating as intended and achieving the desired risk mitigation outcome, which is the primary goal of risk treatment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Regular testing shows the control consistently reduces the risk to the desired level
Why this is correct
Testing provides evidence that the control is achieving its objective.
- ✗
The control is automated and runs daily
Why it's wrong here
Frequency does not equate to effectiveness.
- ✗
The control is documented in a policy
Why it's wrong here
Documentation does not guarantee effectiveness.
- ✗
The cost of the control is lower than the potential loss
Why it's wrong here
Cost-effectiveness is a consideration but not a direct measure of effectiveness.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 983 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.