CRISC Risk Response and Mitigation Practice Question
Which TWO of the following are valid reasons to accept a risk rather than mitigate it?
⚠ Common exam trap
Many exam-takers confuse risk acceptance with risk avoidance or assume any risk can be accepted, but CRISC requires that acceptance only applies when the risk is within the risk appetite and does not violate compliance mandates.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The risk level is within the risk appetite
Accepting a risk is appropriate when the residual risk level falls within the organization's defined risk appetite. Risk appetite represents the amount of risk the organization is willing to accept in pursuit of its objectives, and risks within that threshold do not require additional mitigation controls. This aligns with the CRISC principle that risk acceptance is a valid response when the risk is within tolerance levels.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Management is not aware of the risk
Why it's wrong here
Lack of awareness is not a valid reason.
- ✗
The risk relates to regulatory non-compliance
Why it's wrong here
Regulatory risk should not be accepted.
- ✓
The risk level is within the risk appetite
Why this is correct
Acceptance is appropriate when within appetite.
- ✗
The organization wants to avoid the risk entirely
Why it's wrong here
That is avoidance.
- ✓
The cost of mitigation is higher than the potential loss
Why this is correct
Acceptance is cost-effective.
Go deeper
Related to this question
About these practice questions
One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.