Chapter 3 of 4 · ISACA CRISC
Risk Response and Reporting
Risk response, ownership, vendor risk, exceptions, control design and testing, action plans, KRIs, monitoring and reporting.
- 9topics
- 43 minfast track
- 2diagrams and exhibits
- 32%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Risk Response Options and Risk and Control OwnershipCRISC risk response: accept, mitigate, transfer or share, and avoid, how to choose between them, and how to assign and validate…Diagram5 min
- 2Vendor and Supply Chain Risk ManagementCRISC third-party risk: vendor tiering, due diligence, contract clauses, SOC 2 reports, ongoing monitoring, fourth parties…5 min
- 3Issues, Findings, Exceptions and Exemptions ManagementCRISC issue management: logging findings, tracking remediation, policy exceptions versus exemptions, compensating controls…4 min
- 4Control Frameworks, Types and StandardsCRISC control types and frameworks: preventive, detective, corrective and more; administrative, technical, physical; ISO/IEC…4 min
- 5Control Design, Selection, Implementation and AnalysisCRISC control design: design principles, cost-benefit selection, working with control owners, gap analysis, adequacy…5 min
- 6Control Testing MethodologiesCRISC control testing: design versus operating effectiveness, inquiry, observation, inspection, reperformance, sampling and…5 min
- 7Risk Action Plans and Risk Data Collection and ValidationCRISC risk action plans and risk data: tracking treatment, validating execution, and collecting, aggregating, analysing and…5 min
- 8Risk and Control Metrics (KRIs, KCIs, KPIs)CRISC metrics: how KRIs, KCIs and KPIs differ, leading and lagging indicators, KRI selection criteria, thresholds, and refining…Diagram5 min
- 9Risk Monitoring, Reporting and Emerging RisksCRISC monitoring and reporting: continuous monitoring, heat maps, scorecards and dashboards for each audience, and spotting and…5 min
About this chapter
What this chapter covers
Risk Response and Reporting is 32% of the ISACA CRISC exam, the largest domain. It tests whether you can work with risk owners and control owners to treat risk, evaluate and improve controls, and give stakeholders the risk and control information they need to make decisions.
In this domain, risk response (3A) covers response options, risk and control ownership, vendor and supply chain risk, and issues, findings, exceptions and exemptions. Control design and implementation (3B) covers control frameworks, types and standards, control design and selection, and control testing. Risk monitoring and reporting (3C) covers risk action plans, risk data, KRIs, KCIs and KPIs, monitoring techniques, reporting techniques and emerging risks.
Expect many "who should" questions: who accepts risk, who owns a control, who approves an exception. Expect "BEST metric" questions too, where you choose between a KRI, a KCI and a KPI.
How the topics fit together
The risk owner chooses a response, controls are designed and tested with their owners, and action plans are tracked to completion. Monitoring and reporting then show whether risk stays within appetite and feed the next cycle of decisions.
The risk practitioner recommends, facilitates and reports. The risk owner decides on the response and accepts residual risk, and the control owner makes the control work. Keep those three roles separate and many questions answer themselves.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables and examples.
- What to remember for the exam: the facts to memorise and how questions are phrased.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Ready for more practice?
The full ISACA CRISC question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.