Exam CRISC topic 1 question 283 discussion

In the context of risk management, the effectiveness of a chosen risk mitigation method is ensured by its ability to reduce the impact or likelihood of the identified risk. The primary goal of risk mitigation is to lower the potential adverse effects that the risk may have on the project. Among the provided options, minimization of residual risk is the most comprehensive measure to determine the effectiveness of risk mitigation. Residual risk is the remaining risk after mitigation efforts have been applied. If the residual risk is minimized, it indicates that the risk mitigation methods have successfully reduced the overall risk to an acceptable level. Thus, the correct answer is: D. Minimization of residual risk

The correct answer is D. Minimization of residual risk. Residual risk is the risk that remains after risk mitigation measures have been implemented. It is the difference between the inherent risk (the risk before any mitigation measures are taken) and the mitigated risk. An effective risk mitigation method should minimize residual risk to an acceptable level. This means that the remaining risk should be low enough that it will not significantly impact the project's objectives. Reducing the frequency of a threat, minimizing inherent risk, and reducing the impact of a threat are all important steps in risk mitigation, but they are not sufficient to ensure that the method is effective. If the residual risk is still high, then the mitigation measures are not doing enough to protect the project from harm. Therefore, the most important factor in determining whether a risk mitigation method is effective is whether it minimizes residual risk to an acceptable level.

D. Minimization of residual risk When you opt for risk mitigation, you are primarily concerned with reducing the impact of a threat and minimizing the residual risk that remains after mitigation efforts. Residual risk is the risk that still exists after you have applied mitigation strategies. Therefore, ensuring that the risk mitigation method is effective means minimizing the residual risk to an acceptable level. Options A and C are related to the effectiveness of risk mitigation but do not cover the entire picture, as you should also consider the overall residual risk. Minimizing inherent risk (Option B) is generally done through other risk management activities, like risk identification and assessment, and may not be directly related to the effectiveness of a specific mitigation method.

should be D

The question asks how you can check if the chosen mitigation method is effective. This means that you managed to mitigate the inherent risk (inherent risk is the natural risk level without using controls or mitigations to reduce its impact or severity) resulting in some level of residual risk. Best if the residual risk is minimized therefore answer should be D.

D should be the answer in my view

should be D

Answer is D

Should be D. Residual risk should be minimized

I agree that the explanation is poor and wrong but the answer is right. The Mitigation mostly is about reducing the inherent risk to an acceptable level. Answer C is referring to Threat...

I agree. If risks are identified by a particular architecture, you can change the architecture so the inherent risk is reduced. SO changing the architecture is a way of mitigation.

reduced risk - amount of risk after applied controls, but you can reduce inherent risk by change design for example, so no additional cotrol (and costs to support) needed. so best idea is to reduce inherent risk

This is a wrong answer. The explanation conflicts with the questions.