Evaluating Risk Response Selection

5 minutes 5 Questions

In the Certification in Risk Management Assurance (CRMA) framework, evaluating risk response selection is a core element of assessing whether an organization's risk management process is effective. Once risks have been identified and assessed, management must choose how to respond, and the internal auditor's role is to provide assurance that these choices are appropriate, deliberate, and aligned with the organization's risk appetite and strategic objectives. Risk responses generally fall into four categories: avoid (eliminating the activity that creates the risk), reduce or mitigate (implementing controls to lower likelihood or impact), share or transfer (through insurance, outsourcing, or contracts), and accept (consciously tolerating the risk within appetite). A fifth option, exploit or pursue, applies when the organization seeks to capture an opportunity. The evaluator examines whether management considered the full range of options rather than defaulting to a single approach. Key evaluation criteria include: (1) Alignment with risk appetite and tolerance—does the residual risk after the response fall within approved thresholds? (2) Cost-benefit analysis—are the costs of the response proportionate to the reduction in risk? (3) Consideration of side effects—does the response create new risks or affect other objectives? (4) Ownership and accountability—is a specific risk owner assigned and empowered? (5) Documentation and rationale—is the decision-making process transparent and traceable? (6) Timeliness and feasibility—can the response be implemented within required timeframes and resources? The assurance professional also assesses whether responses are reviewed periodically as conditions change, and whether portfolio-level effects are considered so that aggregated residual risk remains acceptable. Weaknesses commonly found include responses that are merely stated but not implemented, over-reliance on acceptance without formal approval, and failure to link responses to key risk indicators for monitoring. Ultimately, evaluating risk response selection confirms that management's decisions are informed, consistent, and capable of keeping the organization within its defined risk boundaries, thereby supporting reliable achievement of objectives.

Evaluating Risk Response Selection (IIA CRMA)

Why This Topic Matters
Identifying and assessing risks is only half of the risk management cycle. The decisions an organization makes about how to respond to those risks determine whether the risk management process actually protects value. For the CRMA candidate, evaluating risk response selection is central to providing assurance over the effectiveness of enterprise risk management (ERM). Internal audit is uniquely positioned to assess whether management has chosen responses that are aligned with the organization's risk appetite, are cost-justified, and actually bring residual risk within tolerance. A weak or poorly chosen response leaves the organization exposed even when the risk itself was correctly identified.

What It Is
Risk response selection is the step in the risk management process where management decides what to do about an assessed risk. The standard response categories (drawn from COSO ERM and ISO 31000 language) are:
• Avoid – exit or refrain from the activity giving rise to the risk.
• Reduce / Mitigate – implement controls or actions to lower likelihood or impact.
• Share / Transfer – shift a portion of the risk to a third party (insurance, outsourcing, hedging, contractual terms).
• Accept / Retain – take no action because the risk is within appetite or the cost of treatment exceeds the benefit.
• Pursue / Exploit (COSO ERM 2017) – deliberately take on more risk to capture an opportunity.

Evaluating risk response selection means the internal auditor or risk professional reviews management's choice to determine whether it is appropriate, adequately justified, properly implemented, and monitored.

How It Works
A sound evaluation follows a logical sequence:

1. Confirm the baseline. Verify that inherent risk was assessed and that the organization's risk appetite and tolerance for that risk category are defined. A response cannot be judged without knowing the target.

2. Assess alignment with appetite. The chosen response should move residual risk to within the stated tolerance. If management accepts a risk that exceeds appetite, this is a red flag requiring escalation.

3. Evaluate cost versus benefit. The cost of the response (financial, operational, opportunity cost) should be proportionate to the reduction in exposure. Over-controlling a low-impact risk is as much a weakness as under-controlling a critical one.

4. Consider the full range of alternatives. Did management consider multiple response options or default to one? Evidence of a structured decision process (documented options analysis, approvals at the appropriate level) supports the quality of the selection.

5. Check portfolio and interdependency effects. A response to one risk may create or amplify another (e.g., outsourcing reduces operational burden but introduces third-party and data-security risk). Responses should be evaluated at the entity-wide level, not in isolation.

6. Verify implementation and ownership. A selected response is meaningless unless assigned to an accountable owner, resourced, and implemented within a defined timeframe.

7. Evaluate residual risk and monitoring. After implementation, is residual risk reassessed? Are key risk indicators in place to detect if the response is failing or if conditions change?

8. Report and escalate. Findings about inappropriate responses, residual risk above tolerance, or unimplemented actions should be communicated to senior management and the board. Under the IIA Standards, if the CAE believes management has accepted a level of risk that may be unacceptable to the organization, the matter must be discussed with senior management and, if unresolved, escalated to the board.

Key Concepts to Remember
• Inherent risk is the exposure before any response; residual risk is what remains after the response. Evaluation focuses on whether residual risk is acceptable.
• Transfer never eliminates risk completely – the organization retains counterparty risk, reputational risk, and ultimate accountability.
• Acceptance must be a conscious, documented, appropriately authorized decision, not the result of inaction.
• Internal audit evaluates and advises; it does not select the response. Choosing responses is a management responsibility, and doing so would impair audit independence.

Common Weaknesses Auditors Find
• Responses chosen without reference to appetite or tolerance.
• No documented rationale or options analysis.
• Reliance on insurance or contracts as full "transfer" while ignoring retained exposures.
• Controls designed but never implemented, or owners not assigned.
• Failure to reassess residual risk after the response.
• Inconsistent treatment of similar risks across business units.

Exam Tips: Answering Questions on Evaluating Risk Response Selection

Tip 1 – Anchor every answer to risk appetite. When a question asks whether a response is appropriate, the best answer almost always references whether residual risk falls within the organization's stated appetite or tolerance. If an option mentions appetite alignment, give it strong consideration.

Tip 2 – Know the response categories cold. Expect scenario questions that describe an action and ask you to classify it. Buying insurance = share/transfer. Discontinuing a product line = avoid. Adding a review control = reduce. Doing nothing because exposure is low = accept. Entering a new market to capture upside = pursue.

Tip 3 – Remember transfer is partial. If an answer choice says insurance "eliminates" a risk, it is wrong. Look for options that acknowledge retained or residual exposure.

Tip 4 – Respect the independence boundary. Options where the internal auditor "selects," "designs," or "implements" the risk response for management are incorrect. The auditor evaluates, advises, and reports.

Tip 5 – Apply cost-benefit reasoning. If a scenario describes an expensive control over a trivial risk, the correct evaluation is that the response is disproportionate, not that "more control is always better."

Tip 6 – Watch for unimplemented or unowned responses. A response that exists only on paper is a finding. Questions describing "planned" actions with no owner or deadline are testing this.

Tip 7 – Know the escalation path. When management has accepted a risk the CAE believes is unacceptable, the sequence is: discuss with senior management; if unresolved, report to the board. Options skipping senior management or stopping short of the board are incomplete.

Tip 8 – Think portfolio, not silo. If a question hints that a response to one risk affects another area (outsourcing, new vendor, automation), the best answer recognizes interdependencies and aggregate exposure.

Tip 9 – Use elimination on "best" questions. CRMA questions often have more than one plausible option. Discard any option that (a) ignores appetite, (b) assumes risk is fully eliminated, (c) places management decisions on the auditor, or (d) treats implementation as unnecessary. The remaining option is usually correct.

Tip 10 – Distinguish evaluation from assessment. Risk assessment is about likelihood and impact of the risk itself; evaluating the response is about the adequacy of what management did about it. Read the question stem carefully to see which stage is being tested.

Summary
Evaluating risk response selection requires the CRMA candidate to judge whether management's chosen response is aligned with appetite, proportionate in cost, properly considered against alternatives, implemented with clear ownership, and monitored so that residual risk stays within tolerance. On the exam, anchor your reasoning to risk appetite, keep management and audit roles distinct, remember that no response fully eliminates risk, and follow the correct escalation path when unacceptable risk is retained.
Test mode:
Start practice test

CRMA - Evaluating Risk Response Selection Example Questions

Test your knowledge of Evaluating Risk Response Selection

Question 1

During a review of a business unit's risk assessment, an internal auditor finds that a supplier-concentration risk was assessed as exceeding the organization's risk appetite. The unit manager chose to accept the risk. A cost-benefit analysis showed that dual sourcing would cost more than the expected loss. The manager recorded the decision in the risk register, and no further approval was sought. Which conclusion is MOST appropriate?

Correct Answer: The acceptance decision lacked escalation to an authority empowered to retain risk above the board-approved appetite level.

Retaining a risk that exceeds board-approved appetite requires escalation to an authority empowered to accept it, so the unit manager's unilateral acceptance is a governance failure, whatever the economics.
A favorable cost-benefit analysis justifies the choice of response, but it does not give a manager authority beyond their delegation, and recording the decision in the register is not approval. Acceptance is a valid response even above appetite if it is properly authorized, so insurance transfer is not mandatory. Internal audit endorsing the decision would make audit part of management's decision and impair its independence.
Key concept: risk acceptance authority and escalation of risks above appetite.

Question 2

A business unit rated data-processing errors as a high risk and chose to outsource the process to a service provider. Management's justification states that the contract shifts liability for errors to the provider. An internal auditor has been asked to evaluate whether this response was a sound choice. Which procedure would BEST support the auditor's evaluation of the response selection?

Correct Answer: Check that management assessed the new risks the provider creates

Outsourcing transfers execution and some financial consequences, but accountability for the risk stays with the organization. Outsourcing also brings new risks, such as provider failure, data security, concentration and dependency. Checking that management assessed these risks tests whether the response choice was sound.
Confirming that the contract moves liability only verifies management's own flawed premise, since contracts cannot transfer ultimate accountability or reputational impact. Testing the provider's error rate evaluates how well the response performs after implementation, not whether it was a sound choice. Comparing fees with prior cost addresses cost efficiency but ignores the risks the response creates.
Key concept: risk transfer creates secondary risks, and accountability cannot be outsourced.

Question 3

During an assurance review of a business unit's risk assessment, an internal auditor notes that management chose to purchase insurance as its response to a high-rated supplier-failure risk. The supporting documentation records the inherent risk score and the annual premium, but little else about the decision. Which evaluation would BEST indicate whether management's selected response was appropriate?

Correct Answer: Whether the expected residual risk after insurance falls within appetite at a justified cost

A risk response is appropriate when it brings the expected residual risk within the organisation's risk appetite at a cost justified by the benefit gained. So the auditor should confirm that management assessed both the post-insurance exposure and the cost-benefit trade-off.
Inherent risk is measured before any response, so it cannot show the effect of insurance. Comparing the premium with the maximum absorbable loss ignores the residual exposure left after deductibles, exclusions and limits, and ignores appetite. A heat map shift from red to amber is a cosmetic change in rating and does not prove the risk is within appetite or that the cost is justified.
Key concept: evaluating risk responses through residual risk, appetite and cost-benefit.

More Evaluating Risk Response Selection questions
19 questions (total)
Start 19 question test

Other Evaluating Risk Management Processes concepts

Application ControlsBusiness Unit Risk Management EffectivenessChange Management ControlsControl Design and Operating EffectivenessCybersecurity Risk AssessmentData Privacy Risks and ControlsEfficiency of Risk Management ActivitiesEvaluating Risk Assessment MethodologyEvaluating Risk Identification ProcessesInformation Security Policies and PracticesIT General ControlsMonitoring Risk Mitigation PlansOngoing and Separate MonitoringOrganizationwide Risk Management EffectivenessPre- and Post-Implementation ReviewsPrivacy FrameworksProcess-Level Risk Management EffectivenessProject Management Controls in System DevelopmentRisk Criteria and Rating ScalesRisk Management in the SDLCRisk Owners and AccountabilityRisk Registers and Risk DatabasesThird-Party and Cloud Technology Risk
All Evaluating Risk Management Processes questions · CRMA practice test