Certified in Risk and Information Systems Control (CRISC) — Question 675

Which of the following would provide the MOST useful input when evaluating the appropriateness of risk responses?

Answer options

• A. Cost-benefit analysis
• B. Control objectives
• C. Incident reports
• D. Risk tolerance

Correct answer: A

Explanation

A cost-benefit analysis offers a clear comparison of the potential costs of implementing risk responses against the benefits, making it the most useful input for evaluating their appropriateness. Control objectives, incident reports, and risk tolerance are important factors but do not provide as direct a measure of effectiveness as a cost-benefit analysis does.