Exam CRISC topic 1 question 1200 discussion

A - The primary purpose of completing risk mitigation action plans is to reduce the level of risk to the organization

This is covered in the 7th edition of the review manual, pg 161 3.8.3 and pg 165 3.9.2. Pg 161 talks only about updating documentation related to the control. Pg 165 talks about after the control is deemed effective, update the risk register. If you think the question is making a point of omitting that the control has been evaluated as effective, then "control inventory" is the best answer. If you think it is about remembering to update the risk register then A seems the better answer. Horrible question :)

the successful implementation of the control will lower the risk rating. so its A IMO.

Correction, reason: The risk rating is a measure of the likelihood and impact of a risk occurring, and it takes into account both the probability and impact of the risk event. If the risk mitigation plan has successfully reduced either the probability, impact, or both, then updating the risk rating will capture the net effect of the mitigation plan.

If the risks have been mitigated, "the most important" of the options presented is to update the impact, which will modify the rating.

control inventory should be updated once risk mitigation action plans have been verified as completed. A control inventory is a list of all the controls that an organization has in place to manage risk. It is important for the IT risk practitioner to update the control inventory once risk mitigation action plans have been verified as completed, as this helps to ensure that the inventory is accurate and up-to-date.

control inventory.

changing the impact will change the rating automatically...

should be A