Inherent and Residual Risk CRISC Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A risk assessment team is evaluating a new business process. They have limited time and resources. The team is debating whether to assess inherent risk first or go directly to residual risk. What is the best approach?

   • AAssess both simultaneously to save time
   • BAssess residual risk directly to save time
   • CAssess only the controls
   • DAssess inherent risk first, then residual risk
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A risk manager is deciding whether to accept a risk or implement additional controls. The inherent risk is high, but the residual risk after current controls is within the organization's risk appetite. What should the risk manager do?

   • ATransfer the risk to a third party
   • BImplement additional controls to reduce the inherent risk
   • CReassess the inherent risk to ensure it is accurate
   • DAccept the residual risk as it is within the risk appetite
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A risk assessment team is evaluating a new data center. They have identified the inherent risk and are now evaluating the effectiveness of the existing physical and logical controls. What should they do next?

   • ADocument the inherent risk
   • BImplement new controls
   • CReport to senior management
   • DCalculate the residual risk
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   During a risk assessment, a team is evaluating a new customer relationship management (CRM) system. They have identified the inherent risk and are now considering the existing security controls. What is the next step in the process?

   • ADetermine the residual risk by evaluating the effectiveness of controls
   • BCompare the inherent risk to the risk appetite
   • CImplement additional controls immediately
   • DDocument the inherent risk and stop the assessment
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   In a risk assessment process, which of the following is typically performed FIRST?

   • AEvaluate control effectiveness
   • BDefine risk appetite
   • CAssess inherent risk
   • DDetermine residual risk
   Reveal Solution Discussion Select an answer first