Inherent and Residual Risk CRISC Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   After assessing inherent risk, what is the NEXT step in determining residual risk?

   • AImmediately compare inherent risk to risk appetite
   • BImplement additional controls
   • CDocument the inherent risk in the risk register
   • DIdentify and evaluate the effectiveness of existing controls
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following BEST defines residual risk?

   • AThe risk that is acceptable to the organization
   • BThe risk that exists before any controls are considered
   • CThe risk that is transferred to a third party
   • DThe risk that remains after controls are applied
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company has a high inherent risk for a new product launch. After implementing a series of controls, the residual risk is still above the risk appetite. What does this indicate?

   • AThe inherent risk was incorrectly assessed
   • BThe controls are working as intended
   • CThe controls are not sufficient to bring the risk to an acceptable level
   • DThe risk appetite is too low
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   After implementing a set of controls, the risk that still exists is referred to as:

   • AControl risk
   • BInherent risk
   • CResidual risk
   • DAcceptable risk
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Why is it important to distinguish between inherent and residual risk?

   • ATo eliminate all risk from the organization
   • BTo determine the exact cost of controls
   • CTo evaluate the effectiveness of controls and make informed risk management decisions
   • DTo comply with regulatory requirements only
   Reveal Solution Discussion Select an answer first