CRISC · Question #572
During the control evaluation phase of a risk assessment, it is noted that multiple controls are ineffective. Which of the following should be the risk practitioner's FIRST course of action?
The correct answer is A. Compare the residual risk to the current risk appetite. When controls are found ineffective, the risk practitioner's immediate priority is to assess if the resulting residual risk exceeds the organization's acceptable risk appetite.
Question
During the control evaluation phase of a risk assessment, it is noted that multiple controls are ineffective. Which of the following should be the risk practitioner's FIRST course of action?
Options
- ACompare the residual risk to the current risk appetite.
- BRecommend risk remediation of the ineffective controls.
- CImplement key control indicators (KCIs).
- DEscalate the control failures to senior management.
How the community answered
(35 responses)- A46% (16)
- B9% (3)
- C14% (5)
- D31% (11)
Why each option
When controls are found ineffective, the risk practitioner's immediate priority is to assess if the resulting residual risk exceeds the organization's acceptable risk appetite.
If controls are ineffective, the existing risk is not being mitigated as expected, leading to a higher residual risk. The first step is to compare this higher residual risk against the organization's defined risk appetite to determine if it is still acceptable or if immediate action is required.
Recommending remediation is a subsequent step after determining if the residual risk exceeds the appetite.
Implementing KCIs might be part of a broader control monitoring strategy but is not the immediate first action when existing controls are found ineffective.
Escalation to senior management is appropriate if the residual risk exceeds the appetite and requires executive decision, but comparing to appetite comes first.
Concept tested: Risk assessment post-control evaluation
Topics
Community Discussion
No community discussion yet for this question.