CRISC · Question #122
The MAIN purpose of selecting a risk response is to.
The correct answer is D. mitigate the residual risk to be within tolerance. The primary purpose of selecting a risk response is to manage identified risks, aiming to reduce the remaining (residual) risk to an acceptable level within the organization's risk tolerance.
Question
The MAIN purpose of selecting a risk response is to.
Options
- Aensure compliance with local regulatory requirements
- Bdemonstrate the effectiveness of risk management practices.
- Censure organizational awareness of the risk level
- Dmitigate the residual risk to be within tolerance
How the community answered
(39 responses)- A8% (3)
- B3% (1)
- C3% (1)
- D87% (34)
Why each option
The primary purpose of selecting a risk response is to manage identified risks, aiming to reduce the remaining (residual) risk to an acceptable level within the organization's risk tolerance.
While compliance can be a driver for risk management, ensuring compliance is a consequence or a specific goal, not the main overarching purpose of selecting a risk response itself.
Demonstrating effectiveness is an outcome of good risk management, but the selection of a response is the active step to address the risk, not merely to demonstrate practice.
Ensuring organizational awareness of risk is part of risk communication and identification, preceding or accompanying risk response, but the response itself is about acting on the risk.
Selecting a risk response is fundamentally about actively managing an identified risk to ensure that its potential impact and likelihood are reduced or controlled such that the remaining residual risk falls within the organization's predefined risk tolerance or appetite.
Concept tested: Purpose of risk response
Source: https://csrc.nist.gov/publications/detail/sp/800-39/final
Topics
Community Discussion
No community discussion yet for this question.