CRISC Risk Response and Treatment Quiz

1. Which of the following best describes residual risk?

Risk that cannot be identified

Risk remaining after treatment controls are applied

Risk transferred to external parties

Risk accepted without any controls

Submit

3. The effectiveness of risk treatment depends primarily on which factor?

The size of the organization

Proper implementation and ongoing monitoring

Risk documentation quality

Executive awareness alone

4. Which response strategy is appropriate when an organization lacks capability to mitigate a specific risk?

Mitigation

Transfer or outsourcing

Elimination

Documentation only

5. Risk treatment plans should include monitoring mechanisms to ensure control effectiveness. True or False?

True

False

6. Cost-benefit analysis should inform which aspect of risk treatment selection?

Risk identification

Determining whether controls are justified

Risk monitoring frequency

Audit planning

Submit

8. What is the relationship between risk criteria and risk response decisions?

No relationship exists

Criteria help determine appropriate response strategies

Criteria eliminate the need for responses

Criteria only apply to financial risks

9. Risk response accountability should be assigned to which role?

The risk owner

The internal auditor

The compliance officer

The IT department

10. Inherent risk is the risk level before controls are implemented. True or False?

True

False

11. Which risk response strategy involves taking actions to reduce the probability or impact of a risk event?

Mitigation

Avoidance

Acceptance

Transfer

12. When should risk response plans be reviewed and updated?

Only during annual compliance audits

When significant organizational changes occur

Never, once established

Only when a risk event materializes

13. What is a key advantage of implementing compensating controls?

They eliminate all risk

They provide alternative protection when primary controls are inadequate

They reduce audit costs

They replace the need for risk monitoring

14. Risk appetite and risk tolerance should be documented to guide which aspect of risk management?

Risk response selection

Risk identification only

Risk reporting format

Risk owner assignment

15. A detective control identifies and reports when a risk event has already occurred. True or False?

True

False

16. Which control type is designed to prevent a risk event from occurring?

Detective control

Preventive control

Corrective control

Compensating control

17. What does risk transfer accomplish in a risk response plan?

Eliminates the risk entirely

Shifts financial responsibility to another party

Reduces the probability of occurrence

Increases organizational control

18. Risk avoidance typically involves which action?

Implementing preventive controls

Discontinuing activities that create the risk

Purchasing insurance

Monitoring risk indicators

19. Which response strategy is most appropriate when the cost of mitigation exceeds potential impact?

Mitigation

Avoidance

Acceptance

Escalation

20. What is the primary objective of risk treatment in the CRISC framework?

Eliminate all organizational risks

Reduce risk to acceptable levels

Transfer all risks to third parties

Document risks without action

CRISC Risk Response and Treatment Quiz

1. Which of the following best describes residual risk?

2.

What first name or nickname would you like us to use?

2. _____ risk represents the exposure that remains after all treatment responses are implemented.

3. The effectiveness of risk treatment depends primarily on which factor?

4. Which response strategy is appropriate when an organization lacks capability to mitigate a specific risk?

5. Risk treatment plans should include monitoring mechanisms to ensure control effectiveness. True or False?

6. Cost-benefit analysis should inform which aspect of risk treatment selection?

7. A _____ control is implemented after a risk event occurs to restore normal operations.

8. What is the relationship between risk criteria and risk response decisions?

9. Risk response accountability should be assigned to which role?

10. Inherent risk is the risk level before controls are implemented. True or False?

11. Which risk response strategy involves taking actions to reduce the probability or impact of a risk event?

12. When should risk response plans be reviewed and updated?

13. What is a key advantage of implementing compensating controls?

14. Risk appetite and risk tolerance should be documented to guide which aspect of risk management?

15. A detective control identifies and reports when a risk event has already occurred. True or False?

16. Which control type is designed to prevent a risk event from occurring?

17. What does risk transfer accomplish in a risk response plan?

18. Risk avoidance typically involves which action?

19. Which response strategy is most appropriate when the cost of mitigation exceeds potential impact?

20. What is the primary objective of risk treatment in the CRISC framework?