CRISC · Question #516
Which of the following is a PRIMARY reason for considering existing controls during initial risk assessment?
The correct answer is C. To determine the current risk level. During an initial risk assessment, considering existing controls is crucial to determine the current risk level, also known as residual risk, which is the risk remaining after controls are applied. This provides a realistic view of the organization's present risk posture.
Question
Which of the following is a PRIMARY reason for considering existing controls during initial risk assessment?
Options
- ATo determine the inherent risk level
- BTo determine the acceptable risk level
- CTo determine the current risk level
- DTo determine the desired risk level
How the community answered
(40 responses)- A3% (1)
- B8% (3)
- C88% (35)
- D3% (1)
Why each option
During an initial risk assessment, considering existing controls is crucial to determine the current risk level, also known as residual risk, which is the risk remaining after controls are applied. This provides a realistic view of the organization's present risk posture.
Inherent risk is the risk level before any controls are considered or applied.
Acceptable risk level is a management decision about how much risk the organization is willing to tolerate, not determined by existing controls.
Considering existing controls during an initial risk assessment allows the practitioner to evaluate the effectiveness of current safeguards and determine the *residual risk*, which is the current risk level after controls have been implemented. This provides a realistic picture of the organization's actual exposure.
Desired risk level is a target for the future, not a measure of the present situation including existing controls.
Concept tested: Risk assessment components (residual risk)
Topics
Community Discussion
No community discussion yet for this question.