CRISC Question 392

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B1

  Explanation: When the cost of a control exceeds the annual loss expectancy (ALE) of the risk, it suggests that the organization is spending more on the control than the anticipated cost of the risk event occurring. This indicates inefficiency in how the risk is being controlled, as the control is disproportionately expensive relative to the potential loss it mitigates.

• Chose C1

  C. risk is efficiently controlled. When the annual cost of a control exceeds the annual loss expectancy (ALE) of the risk, it indicates that the risk is efficiently controlled. In this scenario, the cost of implementing and maintaining the control is justified by the potential reduction in financial impact that the control provides. This means that the organization is spending less to manage the risk than it would potentially lose if the risk were to materialize. Option A suggests that the control is ineffective and should be strengthened, which is not necessarily the case if the control's cost is justified by the potential loss reduction. Option B implies that the risk is inefficiently controlled, which is not accurate based on the information provided. Option D suggests that the control is weak and should be removed, which might not be appropriate if the control is effectively reducing the risk's potential impact.

• Chose B2

  Agree it is B.