Exam CRISC topic 1 question 671 discussion

D. Successive assessments have the same recurring vulnerabilities. When evaluating existing controls during a risk assessment, the greatest concern should be recurring vulnerabilities. This indicates that the controls in place are not effectively mitigating the identified risks. It suggests that there may be fundamental weaknesses in the control environment, and these vulnerabilities continue to pose a threat to the organization. Recurring vulnerabilities can be a sign of various issues, including control ineffectiveness, inadequate risk response planning, or insufficient monitoring and improvement of controls over time. Addressing these recurring vulnerabilities should be a top priority to enhance the organization's security posture and reduce the associated risks. It's essential to identify the root causes of these vulnerabilities and take corrective actions to prevent them from reoccurring.

D seems the best answer. If there are exceptions that are covered with compensating controls, that shows there is a risk mitigation strategy. Multiple risk assessments finding the same vulnerabilities implies the findings from the assessment are not being mitigated.

The biggest risk is that there are still unresolved vulnerabilities, not that the exceptions are approved and also have compensatory control.

I think it should be C

I would think it would be C as well

why not C?