What Must Management Assess First Before Choosing a Risk Response?

Before selecting a final risk response option for a given risk scenario, management should FIRST:

  1. determine the remediation timeline.
  2. evaluate the risk response of similar sized organizations.
  3. determine control ownership.
  4. evaluate the organization’s ability to implement the solution. Source Reference Answer

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

Tests the logical sequencing of risk management by revealing that validating an organization’s capacity to execute a solution must precede all administrative or scheduling decisions.

This CRISC question evaluates the foundational step in risk treatment, emphasizing that organizational feasibility must be validated before committing to a mitigation strategy. Community consensus firmly identifies assessing implementation capability as the critical prerequisite for effective risk decision-making.

Option C is frequently selected due to its focus on accountability, but determining control ownership is an implementation detail that logically occurs only after the viability of the response itself has been confirmed.

Community Discussion (3 comments)

Sara98 👍 1 Selected: D
D. Evaluate the organization’s ability to implement the solution: Before choosing a risk response option, it is essential to assess whether the organization has the necessary resources, expertise, and infrastructure to implement the solution effectively. This ensures that the chosen response can be realistically executed.
K5000ism 👍 1 Selected: D
D. evaluate the organization’s ability to implement the solution.
Joloms 👍 1
Before selecting a final risk response option for a given risk scenario, management should FIRST: C. determine control ownership. Determining control ownership involves identifying who within the organization will be responsible for implementing and managing the chosen risk response option. This step is crucial as it ensures accountability and clarity regarding who will be responsible for executing the chosen solution. Once control ownership is established, management can then proceed with evaluating other aspects such as remediation timeline, organizational ability to implement the solution, and benchmarking against similar organizations' risk responses.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

Selecting a risk response requires a practical assessment of whether the organization possesses the necessary resources, expertise, and infrastructure to execute it. ISACA’s risk management framework prioritizes feasibility analysis to prevent selecting theoretically sound but operationally impossible solutions. Validating implementation capability ensures that the chosen treatment aligns with actual business constraints and can be successfully deployed.

Why the Other Options Are Wrong

Determining a remediation timeline (A) is a project management activity that follows response selection and feasibility validation. Benchmarking against similar organizations (B) provides useful context but does not dictate internal readiness or mandate a specific course of action. Assigning control ownership (C) establishes accountability but assumes the solution is already viable, making it a downstream step rather than a preliminary requirement.

Community Comment Notes

Multiple contributors emphasize that resource and capability assessment directly impacts execution success, aligning with the correct rationale. While one user initially advocated for control ownership, the broader consensus recognizes that administrative assignments cannot precede operational feasibility checks. As noted in [Comment 1], evaluating the organization’s ability to implement ensures realistic execution before finalizing any response.

Official Reference

Exam Strategy

Always map risk management questions to the chronological lifecycle, placing feasibility and resource validation before scheduling or accountability steps. When uncertain, eliminate options that describe implementation activities rather than preliminary assessments to quickly isolate the correct procedural step.

Related Analysis

Which of the following should be the starting point when per

A-Grade

Which of the following deficiencies identified during a revi

A-Grade

As part of its risk strategy, an organization decided to tra

A-Grade

Practice All CRISC Questions

Access 332 questions with complete answers and detailed explanations.

View Full CRISC Practice Test →

← Back to CRISC Study Guide