CRISC · Question #549
Which of the following is MOST important for a risk practitioner to confirm once a risk action plan has been completed?
The correct answer is C. The risk has been mitigated to the intended level.. Once a risk action plan is completed, it is most important for the risk practitioner to confirm that the risk has been mitigated to its intended level, verifying the plan's effectiveness.
Question
Which of the following is MOST important for a risk practitioner to confirm once a risk action plan has been completed?
Options
- AThe risk register has been updated.
- BThe risk tolerance has been recalibrated.
- CThe risk has been mitigated to the intended level.
- DThe risk owner has reviewed the outcomes.
How the community answered
(36 responses)- A3% (1)
- B6% (2)
- C75% (27)
- D17% (6)
Why each option
Once a risk action plan is completed, it is most important for the risk practitioner to confirm that the risk has been mitigated to its intended level, verifying the plan's effectiveness.
Updating the risk register is an administrative task that should happen, but it is secondary to confirming the actual mitigation effectiveness.
Recalibrating risk tolerance is a strategic decision and not a direct consequence or confirmation of a completed risk action plan; tolerance is set for broader organizational context.
The primary objective of a risk action plan is to reduce a specific risk to an acceptable, targeted level. Therefore, the most critical confirmation for a risk practitioner is to verify through monitoring and assessment that the implemented actions have indeed achieved this intended reduction, ensuring the plan was effective.
The risk owner reviewing outcomes is important for accountability and awareness, but the practitioner's technical confirmation of actual risk reduction is more fundamental to the success of the plan itself.
Concept tested: Validating risk treatment effectiveness
Source: https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-30r1.pdf
Topics
Community Discussion
No community discussion yet for this question.