nerdexam
Isaca

CRISC · Question #393

Which of the following situations would BEST justify escalation to senior management?

The correct answer is A. Residual risk exceeds acceptable limits. Escalation to senior management is best justified when residual risk exceeds acceptable limits, as this indicates a potential for harm that the organization is unwilling or unable to tolerate.

Submitted by takeshi77· Apr 18, 2026Risk Response and Reporting

Question

Which of the following situations would BEST justify escalation to senior management?

Options

  • AResidual risk exceeds acceptable limits.
  • BResidual risk is inadequately recorded.
  • CResidual risk remains after controls have been applied.
  • DResidual risk equals current risk.

How the community answered

(24 responses)
  • A
    75% (18)
  • B
    17% (4)
  • C
    4% (1)
  • D
    4% (1)

Why each option

Escalation to senior management is best justified when residual risk exceeds acceptable limits, as this indicates a potential for harm that the organization is unwilling or unable to tolerate.

AResidual risk exceeds acceptable limits.Correct

Residual risk exceeding acceptable limits signifies that the remaining risk, even after controls are applied, is greater than what the organization is prepared to tolerate or absorb. This situation fundamentally challenges the organization's risk appetite and requires senior management's attention and decision-making for further mitigation strategies, risk acceptance, or resource allocation.

BResidual risk is inadequately recorded.

Inadequately recorded residual risk is an operational issue that should be corrected, but it doesn't necessarily indicate an immediate threat level requiring senior management intervention as much as exceeding acceptable limits does.

CResidual risk remains after controls have been applied.

Residual risk remaining after controls have been applied is a normal and expected outcome of risk management; it doesn't automatically necessitate escalation unless it exceeds acceptable limits.

DResidual risk equals current risk.

Residual risk equaling current risk implies that no controls have been applied or that controls have been entirely ineffective, which, while a problem, the critical trigger for escalation is when that remaining risk is *unacceptable*.

Concept tested: Risk appetite and escalation criteria

Topics

#Residual Risk#Risk Escalation#Risk Appetite#Risk Reporting

Community Discussion

No community discussion yet for this question.

Full CRISC Practice