Certified in Risk and Information Systems Control (CRISC) — Question 485

When classifying and prioritizing risk responses, the areas to address FIRST are those with:

Answer options

• A. low cost effectiveness ratios and low risk levels.
• B. high cost effectiveness ratios and low risk levels.
• C. low cost effectiveness ratios and high risk levels.
• D. high cost effectiveness ratios and high risk levels.

Correct answer: C

Explanation

The correct answer is C because high risk levels indicate significant potential impact, and addressing these areas with low cost effectiveness ratios allows for more effective resource allocation. Options A and B do not prioritize high risks, while D, despite having high cost effectiveness ratios, does not address the criticality of high risk levels.