nerdexam
Isaca

CRISC · Question #568

Which of the following is the MOST important consideration when prioritizing risk response?

The correct answer is C. Effectiveness of risk treatment. The most important consideration when prioritizing risk response is the effectiveness of the chosen risk treatment in genuinely reducing risk to an acceptable level.

Submitted by kavita_s· Apr 18, 2026Risk Response and Reporting

Question

Which of the following is the MOST important consideration when prioritizing risk response?

Options

  • ARequirements for regulatory obligations.
  • BCost of control implementation.
  • CEffectiveness of risk treatment.
  • DNumber of risk response options.

How the community answered

(51 responses)
  • A
    10% (5)
  • B
    4% (2)
  • C
    73% (37)
  • D
    14% (7)

Why each option

The most important consideration when prioritizing risk response is the effectiveness of the chosen risk treatment in genuinely reducing risk to an acceptable level.

ARequirements for regulatory obligations.

Requirements for regulatory obligations are important but fall under the broader consideration of ensuring the chosen risk treatment is *effective* at meeting these obligations; effectiveness is a more fundamental consideration for true risk reduction.

BCost of control implementation.

The cost of control implementation is a significant factor in decision-making, but effectiveness ultimately trumps cost if a cheaper option is ineffective, as it will not adequately resolve the risk.

CEffectiveness of risk treatment.Correct

When prioritizing risk responses, it is crucial to select treatments that are not only feasible but also *effective* in achieving the desired reduction in likelihood or impact of a risk. An ineffective treatment, regardless of its cost or regulatory alignment, fails to adequately address the risk, potentially leading to continued exposure or wasted resources, thereby undermining risk management objectives.

DNumber of risk response options.

The number of risk response options does not dictate prioritization; rather, it is about evaluating the quality and efficacy of those options to address the risk.

Concept tested: Risk response prioritization criteria

Source: https://learn.microsoft.com/en-us/compliance/regulatory/risk-assessment-template

Topics

#Risk response prioritization#Risk treatment effectiveness#Risk management principles

Community Discussion

No community discussion yet for this question.

Full CRISC Practice