CRISC · Question #413
The BEST way to validate that a risk treatment plan has been implemented effectively is by reviewing:
The correct answer is D. a post-implementation risk and control self-assessment (RCSA). A post-implementation risk and control self-assessment (RCSA) is the most effective method to validate the effectiveness of a risk treatment plan.
Question
The BEST way to validate that a risk treatment plan has been implemented effectively is by reviewing:
Options
- Aresults of a business impact analysis (BIA).
- Bthe original risk response plan.
- Ctraining program and user awareness documentation.
- Da post-implementation risk and control self-assessment (RCSA).
How the community answered
(20 responses)- A5% (1)
- B10% (2)
- C5% (1)
- D80% (16)
Why each option
A post-implementation risk and control self-assessment (RCSA) is the most effective method to validate the effectiveness of a risk treatment plan.
A BIA identifies critical business processes and their impact, but does not validate the effectiveness of controls implemented to treat risk.
Reviewing the original risk response plan shows intent, but does not validate if the plan was successfully implemented or if the controls are effective.
Training and awareness are components of some control implementations, but their documentation alone doesn't validate the overall effectiveness of the entire risk treatment plan.
A post-implementation RCSA directly assesses whether the implemented controls are operating as intended and whether the risk treatment has achieved its objectives in reducing the identified risks. This systematic evaluation confirms the efficacy of the chosen risk responses.
Concept tested: Validating risk treatment effectiveness
Topics
Community Discussion
No community discussion yet for this question.