CRISC - Risk Response and Reporting (32% of the exam) - Section 3.8

Test controls and evaluate their effectiveness in reducing risk to an acceptable level.

Test controls and evaluate their effectiveness by assessing both design effectiveness - whether the control is capable of meeting its objective - and operating effectiveness - whether it is actually working as designed over time. Use assurance results to determine whether residual risk remains within acceptable thresholds.

Control testingControl effectivenessDesign vs operating effectivenessAssurance

Practice question for this objective

Free sampleRisk Response and Reportingmedium

After a control test, a reviewer confirms that an automated reconciliation ran on schedule and matched every transaction for the period. The residual risk, however, still sits above the level the risk owner has accepted. What should the practitioner conclude when judging control effectiveness?

AThe control is fully effective because the automated reconciliation ran on schedule and produced no exceptions during the entire period under examination.
BThe control is fully effective, and the remaining gap should be reported as an unavoidable inherent risk that no further control activity could realistically reduce.
CThe control is ineffective and must be replaced entirely, because any residual risk above appetite proves the existing reconciliation logic was the wrong control to choose.
DThe control is operating as designed yet not effective overall, because residual risk remains above the accepted level and additional treatment is still required. Correct

Control effectiveness is judged against reducing residual risk to the accepted level, not merely by whether the control ran without exceptions. A control can operate exactly as designed and still leave residual risk above appetite, so the test of effectiveness is the resulting risk level rather than clean execution, which is why further treatment is needed when the gap persists.

Why A is wrong: Tempting because clean operation looks like success, but effectiveness is measured against reducing risk to the accepted level, which has not been achieved here.

Why B is wrong: Tempting since some risk is inherent, but labelling the gap unavoidable ignores that residual risk above appetite still signals the control is not yet sufficient.

Why C is wrong: Tempting as a strong response, but a working control that leaves a gap may need supplementing rather than wholesale replacement, so this overstates the failure.

Why D is correct: Correct because effectiveness is judged by whether risk is reduced to the accepted level, so a control that runs cleanly but leaves excess residual risk is not yet effective.

See more CRISC practice questions, answers explained.

Exam traps in Risk Response and Reporting

Answers that look right on this material and are not. Each one is a distractor from a different question in the CRISC bank for this domain.

Choose Control Y in every case, because the option that leaves the lowest possible residual risk is always the correct selection
Why it is wrong: Picking the lowest residual risk regardless of cost ignores proportionality; the extra spend on Control Y may buy a reduction worth far less than its added cost.
The control is designed well and operating well, since the role mapping demonstrates that the procedure was actually followed across the quarter under review.
Why it is wrong: Tempting because the design looks sound, but the unapproved grants show the procedure was not consistently applied, so claiming sound operation is not supported by the log evidence.
The owner lacks the technical knowledge of the payments controls, so the testing would miss the detailed criteria that an outside specialist would otherwise apply.
Why it is wrong: Tempting because skill matters, but the owner usually knows the controls well, so the genuine issue is independence rather than a shortfall in technical knowledge.

Examworthy is not affiliated with or endorsed by ISACA. Original, blueprint-aligned practice material only.