nerdexam
Isaca

CRISC · Question #163

After entering a large number of low-risk scenarios into the risk register, it is MOST important for the risk practitioner to:

The correct answer is D. analyze changes to aggregate risk. After identifying numerous low-risk scenarios, it is most important for a risk practitioner to analyze how these individual risks contribute to the overall aggregate risk of the organization. Even small, seemingly insignificant risks can collectively become a significant threat…

Submitted by cyberguy42· Apr 18, 2026Risk Response and Reporting

Question

After entering a large number of low-risk scenarios into the risk register, it is MOST important for the risk practitioner to:

Options

  • Aprepare a follow-up risk assessment.
  • Brecommend acceptance of the risk scenarios.
  • Creconfirm risk tolerance levels.
  • Danalyze changes to aggregate risk.

How the community answered

(43 responses)
  • A
    5% (2)
  • B
    7% (3)
  • C
    16% (7)
  • D
    72% (31)

Why each option

After identifying numerous low-risk scenarios, it is most important for a risk practitioner to analyze how these individual risks contribute to the overall aggregate risk of the organization. Even small, seemingly insignificant risks can collectively become a significant threat when combined.

Aprepare a follow-up risk assessment.

Preparing a follow-up risk assessment might be part of a broader risk management cycle, but the immediate and most important step after adding many risks is to understand their collective impact.

Brecommend acceptance of the risk scenarios.

Recommending acceptance of low-risk scenarios without first assessing their aggregate impact could lead to an unknowingly high overall risk exposure.

Creconfirm risk tolerance levels.

Reconfirming risk tolerance levels is an important governance activity, but it's done periodically or when the business context changes significantly, not necessarily as the immediate next step after entering new risks into the register, especially before understanding their impact.

Danalyze changes to aggregate risk.Correct

Even low-risk scenarios, when numerous, can combine to create a significant aggregate risk that exceeds the organization's risk appetite. Analyzing changes to aggregate risk allows the practitioner to understand the cumulative impact of these individual low-level risks and determine if additional controls or treatments are needed to maintain overall risk within acceptable levels.

Concept tested: Aggregate risk management

Source: https://learn.microsoft.com/en-us/compliance/risk/manage-aggregate-risk

Topics

#Aggregate risk#Risk analysis#Risk monitoring#Risk register

Community Discussion

No community discussion yet for this question.

Full CRISC Practice