Risk Response and Mitigation Strategies Flashcards
6 cards from real CRISC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Risk Response and Mitigation Strategies flashcards as text
Which element MUST be included in a risk response plan to ensure accountability?
Answer: Named owner responsible for implementing the response
A risk response plan must identify a specific owner who is responsible and accountable for executing the response within the agreed timeframe.
Which statement BEST describes the difference between a preventive and a detective control?
Answer: Preventive controls stop incidents before they occur; detective controls identify incidents after they begin
Preventive controls block threats before they cause harm, while detective controls identify when a threat event is occurring or has occurred.
When a risk cannot be fully mitigated, the BEST course of action is to:
Answer: Formally accept the residual risk with senior management approval
Formal acceptance of residual risk by senior management ensures that the decision is deliberate, documented, and appropriately authorized.
A corrective control is MOST effective for:
Answer: Minimizing damage and restoring normal operations after a risk event
Corrective controls reduce the impact of a risk that has already materialized by enabling recovery and restoration of normal business operations.
Which approach to risk mitigation involves redesigning a business process to eliminate a risk entirely?
Answer: Risk avoidance through process redesign
Redesigning a process to remove the conditions that create the risk is a form of risk avoidance that eliminates the root cause.
The PRIMARY purpose of a risk treatment plan is to:
Answer: Document agreed responses to specific risks with timelines and owners
A risk treatment plan captures the specific actions, owners, timelines, and resources needed to implement chosen risk responses.