Certified in Risk and Information Systems Control (CRISC) — Question 1313

Which of the following is an output of risk assessment process?

Answer options

• A. Identification of risk
• B. Identification of appropriate controls
• C. Mitigated risk
• D. Enterprise left with residual risk

Correct answer: B

Explanation

The correct answer is B because the identification of appropriate controls is a key output of the risk assessment process, as it involves determining how to manage identified risks. Options A and C refer to aspects of the risk identification and mitigation process, while D describes a consequence of risk management rather than a direct output of the assessment itself.