nerdexam
Isaca

CRISC · Question #274

Which of the following is the MOST important course of action for a risk practitioner when reviewing the results of control performance monitoring?

The correct answer is B. Validate whether the controls effectively mitigate risk. The most important action for a risk practitioner when reviewing control performance monitoring is to validate if the controls are effectively mitigating identified risks.

Submitted by saadiq_pk· Apr 18, 2026Risk Response and Reporting

Question

Which of the following is the MOST important course of action for a risk practitioner when reviewing the results of control performance monitoring?

Options

  • AEvaluate changes to the organization's risk profile.
  • BValidate whether the controls effectively mitigate risk.
  • CConfirm controls achieve regulatory compliance.
  • DAnalyze appropriateness of key performance indicators (KPIs).

How the community answered

(20 responses)
  • A
    15% (3)
  • B
    75% (15)
  • C
    5% (1)
  • D
    5% (1)

Why each option

The most important action for a risk practitioner when reviewing control performance monitoring is to validate if the controls are effectively mitigating identified risks.

AEvaluate changes to the organization's risk profile.

While evaluating changes to the risk profile is important, it is a consequence of controls either working or not, and the first step is to confirm the direct effectiveness of the controls themselves.

BValidate whether the controls effectively mitigate risk.Correct

The fundamental purpose of any control is to mitigate risk. Therefore, the most critical action for a risk practitioner when reviewing control performance is to validate whether these controls are actually achieving their objective of effectively reducing the organization's exposure to identified risks.

CConfirm controls achieve regulatory compliance.

Confirming regulatory compliance is a specific objective for some controls, but the overarching importance is the general effectiveness of risk mitigation, which may or may not be solely compliance-driven.

DAnalyze appropriateness of key performance indicators (KPIs).

Analyzing the appropriateness of KPIs is an activity related to the *measurement* of control performance, not the direct validation of the control's *effectiveness* in mitigating risk.

Concept tested: Control performance monitoring, risk mitigation effectiveness

Source: https://csrc.nist.gov/publications/detail/sp/800-37/rev-2/final

Topics

#Control performance monitoring#Risk mitigation validation#Control effectiveness#Risk practitioner role

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CRISC Practice