Exam CRISC topic 1 question 728 discussion

B. Demonstrating effective risk mitigation The main reason for documenting the performance of controls is to demonstrate their effectiveness in mitigating risks. By documenting control performance, an organization can provide evidence that it is taking proactive steps to manage and reduce risks effectively. This documentation is crucial for compliance, audit purposes, and ensuring that the controls are achieving their intended objectives. While justifying return on investment, providing accurate risk reporting, and obtaining management sign-off are all important aspects of risk management, they are secondary to the primary goal of demonstrating control effectiveness in mitigating risks.

so if the controls are not performing well, we don't document the results? I opt for A.

Agree with B. Showing the controls are effective.

But... The main reason for documenting the performance of controls is to demonstrate effective risk mitigation. By documenting the performance of controls, an organization can provide evidence that the controls have been implemented and are operating effectively. This evidence can be used to demonstrate to stakeholders, such as regulators and auditors, that the organization is effectively mitigating the risks that it faces.

Used to report compliance to management, effective mitigation is demonstrated with key controls.

I think C is the best answer.