CRISC Risk Response and Mitigation Practice Question
Which THREE of the following are key components of an effective risk response plan?
⚠ Common exam trap
Test-takers frequently confuse project management components (like timelines and detailed schedules) with the strategic, decision-oriented components of a risk response plan, leading them to select 'Detailed implementation timeline' instead of recognizing that ownership, strategy, and budget are the three pillars CRISC emphasizes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Documented risk response strategy (e.g., avoid, mitigate, transfer, accept)
A documented risk response strategy (e.g., avoid, mitigate, transfer, accept) is a key component because it formally defines the chosen approach for addressing each identified risk. This documentation ensures that the response aligns with the organization's risk appetite and provides a clear directive for subsequent actions, such as implementing controls or transferring risk via insurance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Documented risk response strategy (e.g., avoid, mitigate, transfer, accept)
Why this is correct
The chosen strategy is a fundamental part of the plan.
- ✗
Detailed implementation timeline
Why it's wrong here
A timeline is a project management artifact, not a core component of the risk response plan itself.
- ✓
Assigned ownership and accountability
Why this is correct
Clear ownership ensures execution and accountability.
- ✗
Regulatory impact analysis
Why it's wrong here
Regulatory impact is part of risk assessment, not the response plan.
- ✓
Resource allocation and budget
Why this is correct
Resources needed to implement the response must be defined in the plan.
Go deeper
Related to this question
About these practice questions
One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.