nerdexam
Isaca

CRISC · Question #250

After undertaking a risk assessment of a production system, the MOST appropriate action is fcr the risk manager to

The correct answer is B. inform the process owner of the concerns and propose measures to reduce them.. After a risk assessment, the most appropriate action for a risk manager is to inform the process owner of the identified concerns and propose risk reduction measures.

Submitted by ngozi_ng· Apr 18, 2026Risk Response and Reporting

Question

After undertaking a risk assessment of a production system, the MOST appropriate action is fcr the risk manager to

Options

  • Arecommend a program that minimizes the concerns of that production system.
  • Binform the process owner of the concerns and propose measures to reduce them.
  • Cinform the IT manager of the concerns and propose measures to reduce them.
  • Dinform the development team of the concerns and together formulate risk reduction measures.

How the community answered

(62 responses)
  • A
    3% (2)
  • B
    81% (50)
  • C
    6% (4)
  • D
    10% (6)

Why each option

After a risk assessment, the most appropriate action for a risk manager is to inform the process owner of the identified concerns and propose risk reduction measures.

Arecommend a program that minimizes the concerns of that production system.

Recommending a general program is too broad and lacks the direct communication and targeted action with the specific accountable party for the system in question.

Binform the process owner of the concerns and propose measures to reduce them.Correct

The process owner has primary accountability and authority over the specific production system and its associated business processes. Informing them ensures that the risks are communicated to the individual with the highest stake and decision-making power for that system, and proposing measures helps facilitate appropriate action and decision-making.

Cinform the IT manager of the concerns and propose measures to reduce them.

While the IT manager is important for technical implementation, the process owner has ultimate responsibility for the business process supported by the production system, making them the primary stakeholder for risk decisions.

Dinform the development team of the concerns and together formulate risk reduction measures.

The development team might be involved in implementing solutions, but they are typically not the primary decision-makers for accepting or mitigating operational risks of a production system; that falls to the process owner.

Concept tested: Risk communication and accountability

Topics

#Risk communication#Stakeholder management#Risk response planning#Process owner responsibility

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CRISC Practice