nerdexam
Isaca

CRISC · Question #617

Which of the following is a risk practitioner's BEST course of action if a risk assessment identifies a risk that is extremely unlikely but would have a severe impact should it occur?

The correct answer is D. Address the risk by analyzing treatment options. For risks with a severe impact but extremely low likelihood, the best course of action is to analyze treatment options to develop a strategic plan.

Submitted by fatima_kr· Apr 18, 2026Risk Response and Reporting

Question

Which of the following is a risk practitioner's BEST course of action if a risk assessment identifies a risk that is extremely unlikely but would have a severe impact should it occur?

Options

  • ARate the risk as high priority based on the severe impact.
  • BObtain management's consent to accept the risk.
  • CIgnore the risk due to the extremely low likelihood.
  • DAddress the risk by analyzing treatment options.

How the community answered

(21 responses)
  • A
    5% (1)
  • B
    5% (1)
  • C
    10% (2)
  • D
    81% (17)

Why each option

For risks with a severe impact but extremely low likelihood, the best course of action is to analyze treatment options to develop a strategic plan.

ARate the risk as high priority based on the severe impact.

Rating the risk as high priority based solely on impact might misrepresent its overall risk score if likelihood is extremely low, and it doesn't specify a course of action beyond prioritization.

BObtain management's consent to accept the risk.

Obtaining management's consent to accept the risk without first analyzing treatment options might be premature and irresponsible, as there might be cost-effective ways to reduce the impact or likelihood.

CIgnore the risk due to the extremely low likelihood.

Ignoring a risk with severe impact, regardless of likelihood, is irresponsible and a failure of risk management duty, as the organization would be completely unprepared if it materialized.

DAddress the risk by analyzing treatment options.Correct

When a risk has a severe impact, even with an extremely low likelihood, it represents a significant potential threat to the organization. The best course of action is to analyze various treatment options (mitigate, transfer, avoid, accept) to develop a strategic response, ensuring the organization has a plan to manage potential consequences should the unlikely event occur, demonstrating due diligence and preparedness.

Concept tested: Risk response for high impact, low likelihood risks

Topics

#Risk assessment outcomes#Risk response planning#Risk treatment options#Risk prioritization

Community Discussion

No community discussion yet for this question.

Full CRISC Practice