Certified in Risk and Information Systems Control (CRISC) — Question 5

You are the project manager of GHT project. You have analyzed the risk and applied appropriate controls. In turn, you got residual risk as a result of this. Residual risk can be used to determine which of the following?

Answer options

• A. Status of enterprise's risk
• B. Appropriate controls to be applied next
• C. The area that requires more control
• D. Whether the benefits of such controls outweigh the costs

Correct answer: C, D

Explanation

The correct answers are C and D because residual risk indicates areas that still need more management and helps in evaluating if the costs of further controls are justified by the benefits. Options A and B are incorrect as they do not directly relate to the implications of residual risk.