nerdexam
Isaca

CRISC · Question #549

Which of the following is MOST important for a risk practitioner to confirm once a risk action plan has been completed?

The correct answer is C. The risk has been mitigated to the intended level.. Once a risk action plan is completed, it is most important for the risk practitioner to confirm that the risk has been mitigated to its intended level, verifying the plan's effectiveness.

Submitted by akirajp· Apr 18, 2026Risk Response and Reporting

Question

Which of the following is MOST important for a risk practitioner to confirm once a risk action plan has been completed?

Options

  • AThe risk register has been updated.
  • BThe risk tolerance has been recalibrated.
  • CThe risk has been mitigated to the intended level.
  • DThe risk owner has reviewed the outcomes.

How the community answered

(36 responses)
  • A
    3% (1)
  • B
    6% (2)
  • C
    75% (27)
  • D
    17% (6)

Why each option

Once a risk action plan is completed, it is most important for the risk practitioner to confirm that the risk has been mitigated to its intended level, verifying the plan's effectiveness.

AThe risk register has been updated.

Updating the risk register is an administrative task that should happen, but it is secondary to confirming the actual mitigation effectiveness.

BThe risk tolerance has been recalibrated.

Recalibrating risk tolerance is a strategic decision and not a direct consequence or confirmation of a completed risk action plan; tolerance is set for broader organizational context.

CThe risk has been mitigated to the intended level.Correct

The primary objective of a risk action plan is to reduce a specific risk to an acceptable, targeted level. Therefore, the most critical confirmation for a risk practitioner is to verify through monitoring and assessment that the implemented actions have indeed achieved this intended reduction, ensuring the plan was effective.

DThe risk owner has reviewed the outcomes.

The risk owner reviewing outcomes is important for accountability and awareness, but the practitioner's technical confirmation of actual risk reduction is more fundamental to the success of the plan itself.

Concept tested: Validating risk treatment effectiveness

Source: https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-30r1.pdf

Topics

#Risk Mitigation#Risk Treatment#Action Plan Effectiveness#Post-Implementation Review

Community Discussion

No community discussion yet for this question.

Full CRISC Practice