CRISC · Question #271
A risk practitioner has established that a particular control is working as desired, but the annual cost of maintenance has increased and now exceeds the expected annual loss exposure. The result is…
The correct answer is B. ineffective. Although a control is technically functioning, it is considered ineffective if its ongoing maintenance costs exceed the expected financial losses it prevents.
Question
A risk practitioner has established that a particular control is working as desired, but the annual cost of maintenance has increased and now exceeds the expected annual loss exposure. The result is that the control is:
Options
- Amature
- Bineffective.
- Coptimized.
- Dinefficient.
How the community answered
(39 responses)- A5% (2)
- B69% (27)
- C18% (7)
- D8% (3)
Why each option
Although a control is technically functioning, it is considered ineffective if its ongoing maintenance costs exceed the expected financial losses it prevents.
A control being mature refers to its established and refined state, not its cost-effectiveness relative to loss exposure.
A control is considered ineffective if its cost outweighs the benefit derived, even if it technically functions as desired. In this scenario, the control's maintenance cost exceeding the expected annual loss exposure means it is no longer a financially sound or practical solution for mitigating the risk, thus failing its ultimate purpose of cost-effective risk reduction.
An optimized control would imply that it provides the best possible balance of effectiveness and cost, which is not the case here since costs exceed benefits.
While 'inefficient' might apply to controls that are not performing optimally, 'ineffective' more accurately describes a control that fails the cost-benefit analysis entirely, making it counterproductive from a risk management perspective.
Concept tested: Control cost-benefit analysis, control effectiveness
Topics
Community Discussion
No community discussion yet for this question.