CRISC · Question #459
Which of the following is the BEST approach when a risk treatment plan cannot be completed on time?
The correct answer is B. Implement compensating controls until the preferred action can be completed. When a risk treatment plan cannot be completed on time, implementing compensating controls is the best approach to temporarily manage the risk.
Question
Which of the following is the BEST approach when a risk treatment plan cannot be completed on time?
Options
- AReplace the action owner with a more experienced individual.
- BImplement compensating controls until the preferred action can be completed.
- CChange the risk response strategy of the relevant risk to risk avoidance.
- DDevelop additional key risk indicators (KRIs) until the preferred action can be completed.
How the community answered
(27 responses)- A7% (2)
- B74% (20)
- C15% (4)
- D4% (1)
Why each option
When a risk treatment plan cannot be completed on time, implementing compensating controls is the best approach to temporarily manage the risk.
Replacing the action owner might address a performance issue, but it does not immediately manage the risk exposure caused by the delay in the treatment plan itself.
Compensating controls provide an interim solution to reduce risk exposure when primary controls are delayed or cannot be fully implemented. They act as temporary measures to maintain an acceptable level of risk until the preferred, permanent treatment plan can be completed.
Changing the risk response strategy to avoidance means eliminating the risk entirely, which might not be feasible or desirable and is a fundamental change in strategy, not a temporary solution for a delay.
Developing additional Key Risk Indicators (KRIs) helps monitor risk, but it does not actively treat or reduce the risk itself while the primary treatment plan is delayed.
Concept tested: Compensating controls
Topics
Community Discussion
No community discussion yet for this question.