nerdexam
Isaca

CRISC · Question #586

An organization has adopted an emerging technology without following proper processes. Which of the following is the risk practitioner's BEST course of action to address this risk?

The correct answer is C. Conduct a risk assessment to determine risk exposure. When an organization adopts an emerging technology without following proper processes, the risk practitioner's best course of action is to conduct a risk assessment to determine the associated risk exposure.

Submitted by sofia.br· Apr 18, 2026IT Risk Assessment

Question

An organization has adopted an emerging technology without following proper processes. Which of the following is the risk practitioner's BEST course of action to address this risk?

Options

  • AAccept the risk because the technology has already been adopted.
  • BPropose a transfer of risk to a third party with subsequent monitoring.
  • CConduct a risk assessment to determine risk exposure.
  • DRecommend to senior management to decommission the technology.

How the community answered

(21 responses)
  • A
    5% (1)
  • B
    5% (1)
  • C
    71% (15)
  • D
    19% (4)

Why each option

When an organization adopts an emerging technology without following proper processes, the risk practitioner's best course of action is to conduct a risk assessment to determine the associated risk exposure.

AAccept the risk because the technology has already been adopted.

Accepting the risk without understanding its full scope and impact is irresponsible, especially when proper processes were bypassed.

BPropose a transfer of risk to a third party with subsequent monitoring.

Proposing a transfer of risk without first understanding the specific risks through an assessment would be premature and potentially ineffective or costly.

CConduct a risk assessment to determine risk exposure.Correct

Conducting a risk assessment is the most appropriate first step because it allows the organization to systematically identify, analyze, and evaluate the risks introduced by the emerging technology. This assessment will determine the actual risk exposure, potential impacts, and likelihood, providing the necessary information to make informed decisions about how to treat the risk.

DRecommend to senior management to decommission the technology.

Recommending decommissioning the technology without first assessing the risks and potential benefits would be an extreme and potentially unjustified measure.

Concept tested: Risk assessment process

Source: https://learn.microsoft.com/en-us/compliance/regulatory/risk-assessment-template-introduction

Topics

#Risk assessment#Risk management process#Emerging technology#Risk identification

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CRISC Practice