CRISC - Risk Response and Reporting (32% of the exam) - Section 3.2

Develop risk treatment plans that assign actions, resources and timelines to bring risk within tolerance.

Develop risk treatment plans that assign a risk owner, define remediation timelines, and allocate the resources required to bring residual risk within tolerance. Distinguish a treatment plan from a simple action list by its accountability structure and formal acceptance milestones.

Risk treatment planAction planRisk ownerRemediation timeline

Practice question for this objective

Free sampleRisk Response and Reportingmedium

After treatment, a residual risk on a customer billing system still sits slightly above the documented tolerance threshold. The control owner proposes to formally accept the remaining exposure. How should the risk practitioner respond to this proposal?

AAllow the control owner to accept the exposure, because the control owner understands the control best and can judge whether it is sufficient
BRecord the control owner acceptance and close the item, because the residual figure exceeds tolerance only by a slim and immaterial margin
CAccept the residual risk personally on behalf of the organisation, because the practitioner has the clearest independent view of the exposure
DEscalate the decision to the risk owner, because accepting residual risk above tolerance rests with the accountable owner, not the control owner Correct

Route acceptance of residual risk above tolerance to the accountable risk owner, since a control owner lacks authority to accept it. Accepting residual risk is an exercise of risk ownership authority because it commits the organisation to live with the remaining exposure. A control owner is accountable only for control operation, so when residual risk exceeds tolerance the practitioner escalates the acceptance decision to the risk owner who can be held accountable for it.

Why A is wrong: Knowing the control well is useful, but operating a control does not grant authority to accept residual exposure that exceeds the agreed tolerance.

Why B is wrong: A small breach still breaches tolerance, and closing on a margin judgement bypasses the proper acceptance authority and leaves the decision undocumented by the owner.

Why C is wrong: Independence is the practitioner role, so accepting risk personally would breach that independence and assume an accountability the practitioner does not hold.

Why D is correct: Residual risk acceptance is a risk ownership decision, so a control owner cannot formally accept it, and the practitioner routes the choice to the accountable risk owner.

See more CRISC practice questions, answers explained.

Exam traps in Risk Response and Reporting

Answers that look right on this material and are not. Each one is a distractor from a different question in the CRISC bank for this domain.

Replace the three remediation actions with a single statement that the residual risk has been formally accepted by the committee
Why it is wrong: Converting the plan to an acceptance is tempting as a quick close-out, but acceptance is a different response choice and abandons the mitigation the committee asked to strengthen.
Begin with the action plans that are cheapest to deliver, so the largest number of treatments can be marked complete within the quarter
Why it is wrong: Maximising the count of closed items is tempting for reporting, but choosing by cost alone can leave the most dangerous exposures untreated while minor ones are cleared.
A weekly status report circulated to the steering group so that progress against the firm completion date can be tracked
Why it is wrong: Status reporting aids oversight and is tempting, but it tracks delivery progress rather than confirming the residual risk has fallen within tolerance.

Examworthy is not affiliated with or endorsed by ISACA. Original, blueprint-aligned practice material only.