mediumMultiple SelectObjective-mapped
CRISC Practice Question: Which TWO of the following are primary purposes…
Which TWO of the following are primary purposes of risk and control monitoring? (Choose two.)
⚠ Common exam trap
Many exam-takers confuse the primary purpose of monitoring (verifying control effectiveness) with secondary or broader objectives like identifying new controls or ensuring full compliance, leading them to select options that are not the core focus of risk and control monitoring.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To verify that controls are operating as intended.
The primary purpose of risk and control monitoring is to verify that controls are operating as intended. This involves ongoing testing and observation to ensure that control activities are effectively mitigating risks to the desired level. Without this verification, an organization cannot confirm that its risk responses are actually working.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
To identify opportunities for implementing new controls.
Why it's wrong here
Implementing new controls is a response to monitoring findings, not the purpose of monitoring itself.
- ✗
To ensure compliance with all regulatory requirements.
Why it's wrong here
Compliance is one aspect, but not the sole primary purpose.
- ✓
To verify that controls are operating as intended.
Why this is correct
Verification of control effectiveness is a core monitoring objective.
- ✓
To provide assurance to stakeholders on risk management.
Why this is correct
Assurance is a key output of monitoring.
- ✗
To eliminate all residual risk.
Why it's wrong here
Elimination of all risk is unrealistic.
Go deeper
Related to this question
About these practice questions
One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.