Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified in Risk and Information Systems Control · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Updating risk register is the first thing to do. No Action is not an action.
Take no action is accepting the risk. Therefore, if the risk is low, it should still be documented in the "watch list" or updated in the risk register. No action is BAD PRACTICE and should not be an acceptable answer.
In ISACA CRISC QnA Database, 'Reviewing Study Task Practice: Risk Treatment/Risk Response Options | Set 1' questionnaires. There is a Question 2 of which the justification of 'No Action' is explained as the following, 'Taking no action is an example of risk acceptance. No action is taken relative to a particular risk, and loss is accepted if it occurs. This is different from being ignorant of risk; accepting risk assumes that the risk is known (i.e., an informed decision has been made by management).'