CRISC - Risk Response and Reporting (32% of the exam) - Section 3.6

Design and select controls proportionate to the assessed risk and the cost of control.

Design and select controls that are proportionate to assessed risk, performing a cost-benefit analysis to confirm the cost of control does not exceed the expected loss it prevents. Recognise when compensating controls are appropriate as a temporary measure where the preferred control cannot be implemented.

Control designControl selectionCost-benefitCompensating controls

Practice question for this objective

Free sampleRisk Response and Reportinghard

A risk practitioner is selecting a control for a low-likelihood but high-impact risk to a customer database. The proposed safeguard costs more each year than the largest single loss the database could plausibly cause. What should the practitioner recommend?

AImplement the proposed safeguard regardless of cost, because protecting customer data is a non-negotiable priority for the organisation
BAccept the risk outright and document the decision, since any control costing more than a single loss is automatically unjustified
CDefer the decision until the database is re-rated, because the current exposure figure is clearly too low to be trusted here
DSelect a less costly control or treatment whose expected benefit is proportionate to the assessed exposure of the database Correct

Select controls whose cost is proportionate to the assessed exposure, rejecting safeguards that cost more than the risk they remove. Control selection is governed by cost-benefit: the value of the reduction in expected loss should justify the cost of the control. When a safeguard costs more each year than the plausible loss, it consumes more value than it protects, so the practitioner should seek a proportionate, lower-cost control or another treatment rather than spend beyond the exposure.

Why A is wrong: Treating data protection as cost-blind feels principled, but spending more than the exposure each year destroys value and ignores the cost-benefit test that control selection requires.

Why B is wrong: Acceptance can be valid, but jumping to it ignores that a cheaper proportionate control may exist; the absolute rule stated here is not how cost-benefit selection works.

Why C is wrong: Deferring to re-rate seems cautious, but nothing suggests the assessment is wrong; delay leaves the risk untreated when a proportionate control could be selected now.

Why D is correct: A control should reduce risk at a cost that does not exceed the exposure it removes, so a proportionate, cheaper option preserves value while still treating the risk.

See more CRISC practice questions, answers explained.

Exam traps in Risk Response and Reporting

Answers that look right on this material and are not. Each one is a distractor from a different question in the CRISC bank for this domain.

Transfer the exposure to an insurer so the financial impact falls on a third party.
Why it is wrong: Transfer through insurance shifts financial impact but adds premium cost, which is hard to justify when the residual loss is already smaller than further treatment spend.
Implement the control, because removing nearly all of the annualised loss expectancy is the goal of any sound control programme.
Why it is wrong: Maximising loss reduction in isolation ignores cost, so it tempts those who equate more control with better risk management, but a control that costs more than the loss it prevents is not proportionate.
Accept the residual risk for the full eighteen months, recording that the platform technically cannot support the preferred control
Why it is wrong: Accepting an above-tolerance risk for that long is tempting because the limitation is real, but it leaves exposure unmanaged when compensating controls could bring it within tolerance.

Examworthy is not affiliated with or endorsed by ISACA. Original, blueprint-aligned practice material only.