, competitor
actions, environmental issues, etc.
The greatest concern when uncontrolled changes are made to the control environment is an increase
in the level of residual risk, which is the amount and type of risk that remains after the
implementation and execution of the risk responses or controls. An increase in the level of residual
risk means that the risk responses or controls are not effective or sufficient to mitigate or prevent the
risks, and that the organization may face unacceptable or intolerable consequences if the risks
materialize.
An increase in the level of residual risk is the greatest concern when uncontrolled changes are made
to the control environment, because it indicates that the organization’s risk profile and performance
have deteriorated, and that the organization may not be able to achieve its objectives or protect its
value. It also indicates that the organization’s risk appetite and tolerance have been violated, and
that the organization may need to take corrective or compensating actions to restore the balance
between risk and return.
The other options are not the greatest concerns when uncontrolled changes are made to the control
environment, because they do not indicate the actual or potential impact or outcome of the risks,
and they may not be relevant or actionable for the organization.
A decrease in control layering effectiveness means a decrease in the extent or degree to which the
organization uses multiple or overlapping controls to address the same or related risks, and to
provide redundancy or backup in case of failure or compromise of one or more controls. A decrease
in control layering effectiveness may indicate a weakness or gap in the organization’s control design
or implementation, but it does not indicate the actual or potential impact oroutcome of the risks,
and it may not be relevant or actionable for the organization, unless the control layering is required
or recommended by the organization’s policies or standards.
An increase in inherent risk means an increase in the amount and type of risk that exists in the
absence of any risk responses or controls, and that is inherent to the nature or characteristics of the
risk source, event, cause, or impact. An increase in inherent risk may indicate a change or variation in
the organization’s risk exposure or level, but it does not indicate the actual or potential impact or
outcome of the risks, and it may not be relevant or actionable for the organization, unless the
inherent risk exceeds the organization’s risk appetite or tolerance.
An increase in control vulnerabilities means an increase in the number or severity of the weaknesses
or flaws in the organization’s risk responses or controls that can be exploited or compromised by the
threats or sources of harm that may affect the organization’s objectives or operations. An increase in
control vulnerabilities may indicate a weakness or gap in the organization’s control design or
implementation, but it does not indicate the actual or potential impact or outcome of the risks, and
it may not be relevant or actionable for the organization, unless the control vulnerabilities are
exploited or compromised by the threats or sources of harm. Reference =
ISACA, CRISC Review Manual, 7th Edition, 2022, pp. 19-20, 23-24, 27-28, 31-32, 40-41, 47-48, 54-55,
58-59, 62-63
ISACA, CRISC Review Questions, Answers & Explanations Database, 2022, QID 174
CRISC Practice Quiz and Exam Prep
