Inherent and Residual Risk CRISC Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following BEST explains the value of knowing both inherent and residual risk?

   • AIt allows management to see the risk reduction achieved by controls
   • BIt helps identify the root cause of the risk
   • CIt guarantees that residual risk is within risk appetite
   • DIt ensures that all risks are transferred to insurance
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   When assessing inherent risk, which of the following is typically assumed?

   • AThe organization has a low risk appetite
   • BNo mitigating controls are in place
   • CControls are partially effective
   • DAll existing controls are operating effectively
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A risk manager is presenting to the board about a new vendor relationship. The board asks why the risk register shows both an inherent risk score of 25 and a residual risk score of 12. What is the primary reason for reporting both values?

   • ATo show the effectiveness of controls in reducing risk
   • BTo calculate the cost-benefit of each control
   • CTo identify the owner of each risk
   • DTo comply with regulatory requirements for dual reporting
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company has a legacy system with an inherent risk score of 80. After implementing a firewall and regular patching, the residual risk score is 40. What does the difference of 40 indicate?

   • AThe residual risk is unacceptable
   • BThe controls are ineffective
   • CThe controls have reduced the risk by 50%
   • DThe inherent risk was overestimated
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A risk team is calculating the residual risk for a new online payment system. The inherent risk is assessed as high, with a likelihood of 40% and impact of $1 million. The controls are expected to reduce likelihood by 25% and impact by 10%. What is the residual risk?

   • A$250,000
   • B$300,000
   • C$270,000
   • D$400,000
   Reveal Solution Discussion Select an answer first