The official CRISC exam pass rate hovers around 55%, meaning nearly half of all candidates fail. The most common reason is not a lack of knowledge but a failure to apply business judgment in Domain 3, which makes up a massive 32% of your score. You can list the four risk responses, but can you choose the most cost-effective one for a specific scenario when all four seem plausible? That is the real test.
CRISC Domain 3, Risk Response and Reporting, covers selecting cost-effective risk treatments (avoid, mitigate, transfer, accept), designing controls, and reporting risk posture to leadership. These practice questions test your business judgment in applying these concepts, which accounts for 32% of the exam score and is a primary reason candidates fail.
Key facts
- Official Body
- ISACA
- Passing Score
- 450 on a 200-800 scale
- Exam Format
- 150 multiple-choice questions
- Domain 3 Weighting
- 32% of the exam (approximately 48 questions)
- Recommended Study
- 100-140 hours
- Average Salary
- $110,000 to $165,000 for certified professionals
What to Expect From These Domain 3 Practice Questions
These sample questions mirror the scenarios you will face on the real CRISC exam. They are not simple definition checks. They are designed to force you to analyze a business situation, weigh competing priorities, and select the best course of action from the perspective of a risk practitioner advising management.
The questions are aligned with the 2026 ISACA CRISC job practice areas for Domain 3, covering:
- Evaluating and selecting risk response options.
- Designing and implementing risk-reducing controls.
- Developing and executing risk action plans.
- Monitoring and reporting on risk and control effectiveness.
As you work through them, don't just find the right answer. Articulate why the other options are less suitable for the business. This is the critical skill VoraPrep develops. If you want to test your knowledge further, you can try VoraPrep's free CRISC practice questions with our adaptive learning engine.
Studying for CRISC? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
Risk Response and Reporting (Risk Treatment, Controls Design) Practice Questions
Read each question carefully. The scenarios contain distractors and contextual details designed to mislead you. Choose the single best answer.
Question 1
A financial services firm identifies a high-impact, low-likelihood risk of a catastrophic data center failure due to a regional power grid collapse. The cost to build a fully redundant, geographically separate hot site is estimated at $5 million annually. The calculated Annualized Loss Expectancy (ALE) for the event is $2 million. Which of the following is the MOST appropriate risk response?
The Correct Answer is C
The correct answer is C) Transfer the risk by purchasing comprehensive business interruption insurance.
Why This is the Best Choice
The thinking process the exam expects is rooted in cost-effectiveness. The cost of the mitigation control ($5 million annually) is more than double the expected annual loss ($2 million ALE). Spending $5M to prevent an expected $2M loss is a poor business decision. Transferring the risk through insurance directly addresses the financial impact of the event. It allows the firm to cap its potential losses for a premium that would be significantly less than the $5 million mitigation cost. For high-impact, low-likelihood events, risk transfer is often the most cost-effective response.
Why the Other Options are Incorrect
- A) Mitigate: This is a classic exam trap. Mitigation sounds proactive, but the cost is not justified by the risk reduction. The CRISC exam will penalize you for choosing an expensive control that isn't cost-effective.
- B) Accept: Accepting a high-impact risk is rarely the best first choice for a critical function in a regulated industry like finance. While possible, exploring more prudent options like transfer is necessary before resorting to acceptance.
- D) Avoid: Migrating all services to the cloud is a massive strategic overhaul, not a simple risk response. This action introduces a host of new risks (vendor lock-in, data sovereignty issues) and is far too extreme for the specific risk described.
Question 2
A risk practitioner is tasked with designing controls for a new online payment processing system. To prevent fraudulent transactions from being completed, which type of control would be MOST effective?
The Correct Answer is C
The correct answer is C) Preventive.
Why This is the Best Choice
The key phrase is "to prevent fraudulent transactions from being completed." This explicitly asks for a control that stops an unwanted event before it happens. A preventive control, such as an Address Verification System (AVS) check or a real-time fraud scoring engine that blocks suspicious transactions, is the only option that actively stops the unwanted event from being completed.
Why the Other Options are Incorrect
- A) Detective: A detective control, like a post-transaction audit log review, would only identify that a fraudulent transaction has already occurred. This is reactive.
- B) Corrective: A corrective control, such as reversing a fraudulent charge, fixes a problem after it has been detected. This is also reactive.
- D) Directive: A directive control, like a policy stating authentication requirements, provides guidance. While important, it is the technical implementation of that policy (the preventive control) that actually stops the fraud in real time.
Question 3
During a risk assessment, a team determines that the Single Loss Expectancy (SLE) for a server failure is $50,000. Historical data shows that a similar failure occurs, on average, once every four years. The company is considering a new backup solution that costs $15,000 per year and is expected to reduce the failure rate to once every ten years. What is the Return on Security Investment (ROSI) for this solution?
The Correct Answer is D
The correct answer is D) -50%.
Why This is the Best Choice
This question requires a precise cost-benefit calculation. A negative ROSI of -50% correctly indicates that the cost of the control outweighs its financial benefit, making it an unsound investment based purely on these numbers.
Step 1: Calculate the current Annualized Loss Expectancy (ALE)
The Annualized Rate of Occurrence (ARO) is 1 failure ÷ 4 years = 0.25. Current ALE = SLE × ARO = $50,000 × 0.25 = $12,500Step 2: Calculate the new ALE with the control
The new ARO is 1 failure ÷ 10 years = 0.10. New ALE = SLE × ARO = $50,000 × 0.10 = $5,000Step 3: Calculate the annual benefit of the control
The benefit is the risk reduction (the difference between the old and new ALE). Annual Benefit = Current ALE − New ALE = $12,500 − $5,000 = $7,500Step 4: Calculate the Return on Security Investment (ROSI)
The formula is: (Annual Benefit − Cost of Control) ÷ Cost of Control ROSI = ($7,500 − $15,000) ÷ $15,000 ROSI = -$7,500 ÷ $15,000 = -0.50 or -50%Why the Other Options are Incorrect
- A) $7,500: This is the annual benefit, not the final ROSI. It's an intermediate step in the calculation.
- C) 50%: This is a common error from forgetting to subtract the cost of the control in the numerator: ($7,500 ÷ $15,000).
- B) -25%: This is simply an incorrect calculation, likely from a math error during one of the steps.
Question 4
When communicating the status of IT risks to the board of directors, a risk practitioner should PRIMARILY focus on:
The Correct Answer is C
The correct answer is C) The potential impact of risks on business objectives and strategic goals.
Why This is the Best Choice
The audience is the board of directors, whose primary responsibility is governance and strategy. They need to understand risk in the language of the business: finance, reputation, market position, and strategic goals. Option C is the only answer that frames risk in this context. For example, instead of "We have a SQL injection vulnerability," you would say "A flaw in our customer portal could lead to a data breach, resulting in an estimated $3M in regulatory fines and significant reputational damage."
Why the Other Options are Incorrect
- A) Technical specifications: This is far too granular for the board. This level of detail is for the IT security team.
- B) A list of all risks: An exhaustive list is counterproductive. The board needs to understand the most significant risks that could derail strategy, which is why risk prioritization is critical.
- D) Operational efficiency: While important to a CISO or IT Director, the board is more concerned with the residual risk the business faces than the efficiency of a specific control.
Question 5
An organization has identified a risk related to its reliance on a single cloud service provider. The organization has a low tolerance for downtime. Which of the following risk responses represents risk mitigation?
The Correct Answer is D
The correct answer is D) Implementing a multi-cloud strategy with a second provider for failover.
Why This is the Best Choice
This question tests your precise understanding of the four risk responses. Mitigation involves applying controls to reduce the likelihood or impact of a risk. A multi-cloud failover strategy does not eliminate the risk of a cloud outage, but it implements a control (the second provider) to reduce its impact (downtime).
| Risk Response | Definition & CRISC Application |
|---|---|
| Avoid | Eliminating the risk by not performing or stopping the activity that causes it. |
| Mitigate | Applying controls to reduce the likelihood or impact of the risk. |
| Transfer | Sharing the financial impact of a risk with a third party (e.g., insurance). |
| Accept | Formally deciding to take no action and accepting the potential consequences. |
Why the Other Options are Incorrect
- A) Purchasing insurance: This is the definition of risk transfer. You are transferring the financial impact to an insurer.
- B) Formally accepting: This is the definition of risk acceptance.
- C) Terminating the contract: This is an example of risk avoidance. You are eliminating the risk by ceasing the activity (using that provider).
Question 6
A Key Risk Indicator (KRI) is MOST effective when it is:
The Correct Answer is C
The correct answer is C) A leading indicator providing an early warning.
Why This is the Best Choice
The primary value of a KRI is its ability to predict an increased likelihood of a risk event. It is a forward-looking metric. An effective KRI has a defined threshold (e.g., "CPU utilization exceeds 90%") that is set based on the organization's risk appetite and tolerance. Breaching this threshold serves as an early warning that a risk is more likely to materialize, allowing for proactive intervention.
Why the Other Options are Incorrect
- A) Lagging indicator: This describes what has already happened (e.g., number of successful attacks last month). It is useful for analysis but not for proactive warning.
- B) Qualitative measure: While some indicators can be qualitative, the most effective KRIs are quantitative and tied to specific, measurable thresholds.
- D) Performance metric: This defines a Key Performance Indicator (KPI), which measures success against an objective (e.g., "system uptime is 99.9%"). A KRI warns of a threat to that KPI. You can learn more in our detailed guide to the CRISC Domain 3 Playbook: Risk Response & KRIs vs KPIs vs KCIs.
Question 7
An organization decides to accept a risk because the cost of implementing any effective control exceeds the potential loss. This decision should be:
The Correct Answer is B
The correct answer is B) Documented and approved by management at the appropriate level of authority.
Why This is the Best Choice
Risk acceptance is an active, formal business decision. The CRISC exam heavily emphasizes that risk ownership lies with the business, not IT. The business process or asset owner is the one who "owns" the potential loss and therefore must be the one to formally accept it. This decision must be documented to provide an audit trail and ensure accountability.
Why the Other Options are Incorrect
- A) Made by the IT department: The IT department can recommend acceptance, but they do not have the authority to accept business risk on behalf of the organization.
- C) Re-evaluated only when an event occurs: Risk acceptance is not permanent. All risks, including accepted ones, must be periodically reviewed (e.g., annually) as the business context and threat landscape change.
- D) Communicated to external auditors: While it may be shared with auditors, the primary approval and accountability must happen internally with the appropriate business leadership.
Question 8
After a new access control system is implemented (a mitigation), the risk of unauthorized access is reduced but not eliminated. The remaining risk is known as:
The Correct Answer is B
The correct answer is B) Residual risk.
Why This is the Best Choice
This is a core vocabulary question. Residual risk is the level of risk that remains after controls have been implemented. The goal of risk management is to reduce inherent risk to a level of residual risk that is within the organization's risk appetite. The basic relationship is: Inherent Risk - Control Effectiveness = Residual Risk.
Why the Other Options are Incorrect
- A) Inherent Risk: This is the level of risk that exists before any controls are applied.
- C) Control Risk: In the context of the CRISC exam, it is more precise to think of control effectiveness or failure as a factor that determines the level of residual risk. The term "Control Risk" is more formally used in financial auditing to describe the risk that a material misstatement will not be prevented or detected by internal controls.
- D) Audit Risk: This is specific to the audit function and refers to the risk that an auditor will issue an incorrect opinion.
Calculate Your CRISC Score & Study Hours by Domain
Adjust your practice scores across official CRISC blueprint domains to predict your pass probability and generate a domain-weighted study schedule.
How to Interpret Your Score
Tally your correct answers. This gives you a snapshot of your current ability to think like the CRISC examiner in Domain 3.
- 7-8 Correct: Excellent. You have a strong grasp of applying risk management principles to business scenarios. Focus now on practicing more complex questions and ensuring you can articulate the "why" behind each choice.
- 4-6 Correct: Solid foundation. You understand the concepts but are likely falling for tempting distractors that are technically correct but not the best business choice. Review the explanations for your wrong answers, focusing on cost-effectiveness and audience.
- 0-3 Correct: This score indicates a need to revisit core Domain 3 definitions. Before tackling more scenario questions, solidify your understanding of control types, the four risk responses, and key terms. Start with our CRISC Exam Cheat Sheet (2026) to rebuild your foundation.
Regardless of your score, the next step is consistent, targeted practice. Simply reading a textbook will not prepare you for the judgment-based nature of the exam.
Get More CRISC Practice on VoraPrep
If these questions highlighted areas for improvement, you've discovered the power of active learning. That's the core of VoraPrep. Our complete CRISC course is a 6-pillar interactive system designed to get you past the 450 passing score efficiently, unlike legacy courses that rely on passive video lectures.
We provide:
- Textbook-Grade Lessons: Step-by-step interactive lessons with embedded questions.
- Adaptive Practice Bank: Over 1,800 exam-calibrated questions with detailed rationales.
- 1:1 Exam Simulators: Full-length, timed mock exams that replicate the real testing environment.
- Spaced-Repetition Flashcards: Smart flashcards to lock in key terms.
- Personalized Study Plan: A dynamic calendar that tells you what to study daily.
- Vory, Your 24/7 Personal Tutor: Instant, step-by-step explanations inside any lesson or question.
You can see how our complete course model compares to older, overpriced bundles in our guide to the Best CRISC Review Courses (2026).