What Must Management Assess First Before Choosing a Risk Response?
Short answer
D evaluate the organization’s ability to implement the solution.
Question
Key Takeaways
Tests the logical sequencing of risk management by revealing that validating an organization’s capacity to execute a solution must precede all administrative or scheduling decisions.
This CRISC question evaluates the foundational step in risk treatment, emphasizing that organizational feasibility must be validated before committing to a mitigation strategy. Community consensus firmly identifies assessing implementation capability as the critical prerequisite for effective risk decision-making.
Common mistake: Option C is frequently selected due to its focus on accountability, but determining control ownership is an implementation detail that logically occurs only after the viability of the response itself has been confirmed.
Expert Analysis
Why the Answer Is Correct
Selecting a risk response requires a practical assessment of whether the organization possesses the necessary resources, expertise, and infrastructure to execute it. ISACA’s risk management framework prioritizes feasibility analysis to prevent selecting theoretically sound but operationally impossible solutions. Validating implementation capability ensures that the chosen treatment aligns with actual business constraints and can be successfully deployed.
Why the Other Options Are Wrong
Determining a remediation timeline (A) is a project management activity that follows response selection and feasibility validation. Benchmarking against similar organizations (B) provides useful context but does not dictate internal readiness or mandate a specific course of action. Assigning control ownership (C) establishes accountability but assumes the solution is already viable, making it a downstream step rather than a preliminary requirement.
Community Comment Notes
Multiple contributors emphasize that resource and capability assessment directly impacts execution success, aligning with the correct rationale. While one user initially advocated for control ownership, the broader consensus recognizes that administrative assignments cannot precede operational feasibility checks. As noted in [Comment 1], evaluating the organization’s ability to implement ensures realistic execution before finalizing any response.
Official Reference
This link opens the official vendor documentation in a new tab.
Exam Strategy
Always map risk management questions to the chronological lifecycle, placing feasibility and resource validation before scheduling or accountability steps. When uncertain, eliminate options that describe implementation activities rather than preliminary assessments to quickly isolate the correct procedural step.
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
Joloms 👍 1Before selecting a final risk response option for a given risk scenario, management should FIRST: C. determine control ownership. Determining control ownership involves identifying who within the organization will be responsible for implementing and managing the chosen risk response option. This step is crucial as it ensures accountability and clarity regarding who will be responsible for executing the chosen solution. Once control ownership is established, management can then proceed with evaluating other aspects such as remediation timeline, organizational ability to implement the solution, and benchmarking against similar organizations' risk responses.
-
Sara98 👍 1 Answered DD. Evaluate the organization’s ability to implement the solution: Before choosing a risk response option, it is essential to assess whether the organization has the necessary resources, expertise, and infrastructure to implement the solution effectively. This ensures that the chosen response can be realistically executed.
-
K5000ism 👍 1 Answered DD. evaluate the organization’s ability to implement the solution.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All CRISC Questions
Access 332 questions with complete answers and detailed explanations.
View Full CRISC Practice Test →