CRISC Question 213

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A2

  Inherent risk is a static measure exists regardless of whether the organization chooses to mitigate it or not. Instead, what changes is how much of that risk the organization is willing to accept without additional controls.

• 1

  A. Lower risk management cost - This option suggests reducing the cost associated with managing risks. B. Decreased residual risk - This option implies lowering the remaining risk after risk management measures have been implemented. C. Higher risk management cost - This option indicates an increase in the expenses related to managing risks. D. Increased inherent risk - This option suggests that the inherent risks, or risks that exist before any risk management actions are taken, have increased. Given these options, it's probable that "B. Decreased residual risk" would receive the most votes. This is because reducing the residual risk after implementing risk management measures is generally a desirable outcome in risk management practices.

• Chose A2

  When an organization raises its risk appetite for technology risk, the most likely result would be A. lower risk management cost. Risk appetite refers to the amount and type of risk that an organization is willing to take in order to meet its strategic objectives. An increase in risk appetite for technology risk means the organization is willing to accept a higher level of risk in this area. This usually leads to a reduction in the extent and cost of risk management activities, as fewer resources are allocated to mitigate risks that are now considered acceptable. In this context: B. Decreased residual risk would not be a direct result of increasing risk appetite; it would be more associated with increasing risk mitigation efforts. C. Higher risk management cost is unlikely because accepting higher risk generally means spending less on managing or mitigating that risk. D. Increased inherent risk is not a direct result of changing risk appetite. Inherent risk exists independently of the organization's attitude towards risk; it's the level of risk in the absence of any actions to alter its impact.