Exam CRISC topic 1 question 869 discussion

A. Risk appetite The MOST important consideration for senior management when developing a risk response strategy should be the organization's risk appetite. Risk appetite defines the level of risk that an organization is willing to accept or tolerate in pursuit of its objectives. It sets the boundaries for risk-taking and guides decision-making regarding which risks to accept, mitigate, transfer, or avoid. Senior management needs to align the risk response strategy with the organization's risk appetite to ensure that risk-taking is consistent with its overall goals and values. The risk response strategy should be designed to keep risk exposures within acceptable limits defined by the risk appetite.

A risk response strategy could mean one of the four responses- accept, transfer, avoid and mitigate. The response strategy is based on appetite and tolerance. Tolerance is only used in exceptional circumstances.. So appetite seems okay but i must say i dont think tolerance is wrong too.

Going with A. You first make decisions based on risk appetite. Then select options based on cost of control.

Risk acceptance should not exceed risk appetite and response actions should be MAINLY aimed at maintaining the level without exceeding it. (7th CRISC manual, 'Risk appetite, tolerance and capacity' section).

I believe a risk response strategy primarily should be based on the risk appetite (which is the ultimate goal to be at level or under). Once risk appetite is considered you can start developing your strategy.

Risk Response brings risk in line with enterprise's defined risk appetite and tolerance as cost-effectively as possible, not to eliminate or minimize the risk at all costs. All response activities incur some cost, typically a mix of the direct cost of response and the potential cost of impact. Finding right balance is a management function. I think B is right

The answer is B - The question states what must be considered when developing risk response strategies?? I believe cost of control must not exceed the risk we are trying to mitigate.

Risk tolerance are developed based on the risks appetite. The risk appetite is also the foundation for risk capacity . So management must look , on a broad scale , what risk will be accepted and still operate smoothly without any interruption(appetite) as the basis for any response strategy.

I would think it would be A.

There is a diff....one has Senior management.

IN keeping with the following question where the answer is A. I suggest the answer should also be risk tolerance Which of the following would be MOST useful to senior management when determining an appropriate risk response? A. A comparison of current risk levels with established tolerance B. A comparison of cost variance with defined response strategies C. A comparison of accepted risk scenarios associated with regulatory compliance D. A comparison of current risk levels with estimated inherent risk levels

Should the answer be B - Cost of Controls The similar type question has answer Cost of Controls Question #662Topic 1 Which of the following should be the HIGHEST priority when developing a risk response? • A. The risk response is accounted for in the budget. • B. The risk response aligns with the organization's risk appetite. • C. The risk response is based on a cost-benefit analysis. • D. The risk response addresses the risk with a holistic view. Correct Answer: C