nerdexam
Isaca

CRISC · Question #312

Which of the following scenarios is MOST likely to cause a risk practitioner to request a formal risk acceptance sign-off?

The correct answer is A. Residual risk in excess of the risk appetite cannot be mitigated. A formal risk acceptance sign-off is required when residual risk exceeds the organization's risk appetite and cannot be further mitigated, necessitating management's explicit acknowledgment.

Submitted by diego_uy· Apr 18, 2026Risk Response and Reporting

Question

Which of the following scenarios is MOST likely to cause a risk practitioner to request a formal risk acceptance sign-off?

Options

  • AResidual risk in excess of the risk appetite cannot be mitigated.
  • BInherent risk is too high, resulting in the cancellation of an initiative.
  • CRisk appetite has changed to align with organizational objectives.
  • DResidual risk remains at the same level over time without further mitigation.

How the community answered

(30 responses)
  • A
    70% (21)
  • B
    20% (6)
  • C
    7% (2)
  • D
    3% (1)

Why each option

A formal risk acceptance sign-off is required when residual risk exceeds the organization's risk appetite and cannot be further mitigated, necessitating management's explicit acknowledgment.

AResidual risk in excess of the risk appetite cannot be mitigated.Correct

Risk acceptance is a formal decision made by management to take responsibility for a particular risk, especially when the residual risk (risk remaining after all feasible mitigation efforts) is greater than the organization's established risk appetite or tolerance and cannot be further reduced.

BInherent risk is too high, resulting in the cancellation of an initiative.

If inherent risk is too high, leading to cancellation, this represents a risk avoidance strategy rather than a scenario for risk acceptance.

CRisk appetite has changed to align with organizational objectives.

A change in risk appetite is a strategic adjustment by leadership, which may lead to re-evaluation of risks but does not, by itself, trigger a formal sign-off for a specific risk.

DResidual risk remains at the same level over time without further mitigation.

Residual risk remaining constant does not automatically require acceptance unless that specific level of risk is above the organization's defined risk appetite.

Concept tested: Risk Acceptance Triggers

Source: https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/reference/nfa-security#risk-definitions

Topics

#Risk Acceptance#Residual Risk#Risk Appetite#Risk Response

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CRISC Practice