Exam CRISC topic 1 question 543 discussion

Tthe BEST indication of an effective risk management program is option C - Residual risk is within the organizational risk appetite. If the residual risk is within the organizational risk appetite, it suggests that the organization has identified and assessed the risks, designed and implemented appropriate controls, and regularly monitored the risks to ensure that they are managed effectively.

C. Residual risk is within the organizational risk appetite. The best indication of an effective risk management program is when the residual risk (the risk that remains after applying controls) is within the organizational risk appetite. An effective risk management program ensures that the organization's risk-taking aligns with its risk tolerance and strategic objectives. Keeping the residual risk within the established risk appetite demonstrates that risks are being identified, assessed, and managed in a way that supports the organization's overall goals and tolerances.

Should be "C", this is the core objective of risk management. When the residual risk is within the risk appetite then you already should have done A,B & D

C seems the most logical answer.

should be C

From the below, D appears more apt. You could have ad-hoc instances where risk actions are approved by mgmt (A) and Implementation of mitigating controls (B). (C) appears incorrect because the risk program may still be very mature but with instances of residual risk beyond the risk appetite. The key basic of maturity is where Risk across the organization is tracked in risk register, which enables prioritization or remediation and risk awareness, etc. So (D) is the right answer. A. Risk action plans are approved by senior management B. Mitigating controls are designed and implemented C. Residual risk is within the organizational risk appetite D. Risk is recorded and tracked in the risk register

echo C

I think it is C. R1-127 is a related question.

C should be the correct answer.

as to know Residual risk we have to have all Risk management stadies passed...also we may not need any mitigiation (if there are inherit Risks are within risk appetite)

why controls? they might be ineffective, why not C. Residual risk is within the organizational risk appetite?