The risk practitioner’s first course of action when an assessment of information security controls has identified ineffective controls should be A. Determine whether the impact is outside the risk appetite1

According to the CRISC Review Manual, risk appetite is the amount and type of risk that an organization is willing to accept in pursuit of its objectives. Risk appetite reflects the organization’s risk culture, strategy, and values2

When an assessment of information security controls has identified ineffective controls, it means that the controls are not providing the expected level of protection or assurance for the information assets or processes. This may result in increased exposure or vulnerability to threats, or reduced ability to achieve objectives. Therefore, the risk practitioner should first determine whether the impact of the ineffective controls is outside the risk appetite, as this would indicate the need for urgent action or escalation3

The other options are not the first course of action when an assessment of information security controls has identified ineffective controls, because:

•B. Requesting a formal acceptance of risk from senior management may be appropriate if the impact of the ineffective controls is within the risk appetite, and the organization decides to accept the risk as it is. However, this should not be the first course of action, as it may not address the root cause of the ineffective controls, or the potential consequences or opportunities for improvement4

•C. Reporting the ineffective control for inclusion in the next audit report may be part of the risk communication and reporting process, but it should not be the first course of action, as it may delay the resolution or mitigation of the issue, or the implementation of corrective actions. Moreover, the next audit report may not be timely or relevant for the decision-makers or stakeholders who need to be informed of the ineffective controls5

•D. Deploying a compensating control to address the identified deficiencies may be a possible risk response option, but it should not be the first course of action, as it may require further analysis, evaluation, and approval. Moreover, deploying a compensating control may not be the most effective or efficient solution, as it may introduce additional complexity, cost, or risk.

1: CRISC Review Questions, Answers & Explanations Database, Question ID: 100003 2: CRISC Review Manual, 7th Edition, page 28 3: CRISC Review Manual, 7th Edition, page 223 4: CRISC Review Manual, 7th Edition, page 224 5: CRISC Review Manual, 7th Edition, page 225 : CRISC Review Manual, 7th Edition, page 226