CRISC Certified in Risk and Information Systems ControlRisk Response and ReportingMedium
During a quarterly risk report presentation, the board of directors expresses concern that several high-priority risks identified in the previous quarter have not shown significant improvement in their residual risk levels. The risk practitioner has confirmed that the agreed-upon mitigation strategies were implemented as planned. What is the MOST likely underlying issue the risk practitioner should investigate?
- AMiscommunication of risk status to the board of directors.
- BInadequate funding allocated for risk response activities.
- CLack of management buy-in for the risk management program.
- DThe implemented controls are not effective in mitigating the identified risks.
Show answer & explanationAnswer & explanation
Correct answer: D. The implemented controls are not effective in mitigating the identified risks.
If mitigation strategies were implemented as planned but residual risk levels haven't improved, it strongly suggests that the implemented controls are not achieving their intended objective. This points to an issue with the effectiveness of the controls themselves, rather than funding, buy-in, or reporting (though these could be secondary issues). The risk practitioner needs to assess why the controls are failing to reduce the risk.
Why the other options are wrong
- A. The board is expressing concern based on the reported status, implying the communication itself might be accurate, but the underlying situation is problematic.
- B. The question states strategies were 'implemented as planned,' suggesting funding was sufficient for implementation, though perhaps not for effective controls.
- C. If mitigation strategies were implemented, it implies some level of management buy-in, so this is less likely to be the primary issue.
Control Effectiveness Assessment
The process of evaluating whether implemented controls are achieving their stated objectives in reducing risk.
- Crucial for validating risk response strategies.
- Involves testing, monitoring, and audit reviews.
- Informs decisions on control improvements or alternative responses.
Memory trick: Implemented Controls = Ineffective Outcomes.