CRISC Domain 3: Risk Response and Reporting (32%)

Overview

Domain 3 covers what happens after risk has been assessed. Part A, risk response, covers the response options, assigning risk and control ownership, vendor and supply chain risk, and managing issues, findings, exceptions and exemptions. Part B, control design and implementation, covers control frameworks and types, how controls are selected and built, and how they are tested. Part C, risk monitoring and reporting, covers action plans, data quality, KRIs, KCIs and KPIs, monitoring techniques, reporting formats and emerging risks.

It is the operational center of the job practice. Domain 1 sets who owns risk and how much is acceptable. Domain 2 measures how much there is. Domain 3 closes the loop by reducing, sharing, avoiding or formally accepting risk, proving the chosen controls work, and keeping decision-makers informed as conditions change. At almost a third of the exam, it also connects most directly back to the other three domains.

Why it matters on the exam

Nearly one question in three comes from this domain, and Domains 1 to 3 together make up 80% of the exam. Candidates struggle because the domain mixes judgment and precision. You need to know that transferring risk does not transfer accountability. You also need to know that a key control indicator measures something different from a key risk indicator, and that asking a control owner whether a control works is the weakest form of evidence. Weakness here is expensive. It costs marks directly, and it undermines answers in Domain 1 about ownership and in Domain 2 about whether residual risk has changed. Strong candidates treat this domain as the place where governance and assessment become concrete.

How it's tested

Questions in this domain present a risk that has already been rated, a control under review, or a metric that has moved, and ask for the BEST response, the MOST reliable evidence, or the MOST useful indicator. Many options will be defensible in isolation. The right one fits the decision-maker, the evidence standard, or the intent behind the metric.

Response selection

Given residual risk, appetite and cost information, choose the response option and the person who should approve it.
Evidence strength

Choose the testing approach or evidence that BEST confirms a control is operating effectively, and rule out weaker sources such as inquiry alone.
Right metric, right audience

Choose the indicator that best signals a change in risk, or the reporting format that best serves a stated audience such as the board.

Reasoning it through

A vendor hosting customer data provides a SOC 2 Type I report. Asked what MOST reduces uncertainty about its controls, ask what that report covers. A Type I report assesses design at a single point in time, not operation over a period. The stronger evidence is a Type II report or other testing of operating effectiveness. Answers that rely on the vendor's assurances or the contract alone are weaker.

Subtopics 13

Official subtopics from the ISACA outline, in outline order.

3.A.1 Risk Response OptionsAccept, avoid, mitigate, or transfer and share.

What it means: Accepting means retaining the risk knowingly and formally. Avoiding means stopping the activity that creates it. Mitigating means reducing likelihood or impact through controls. Transferring or sharing means moving part of the financial consequence to another party, for example through insurance or outsourcing.
What to understand: The right option depends on residual risk relative to appetite, the cost of the response compared with the benefit, and the owner's decision. Acceptance is legitimate when risk is within appetite and is formally documented. Transfer never moves accountability.
How it shows up: A rated risk, its cost profile and the business context are given, and you must choose the most appropriate response or say who must approve it.
Common confusion: Assuming mitigation is always the best answer. If a risk is already within appetite, formal acceptance can be correct, and extra controls would waste resources.

3.A.2 Risk and Control OwnershipWho is accountable for a risk, and who runs the controls that address it.

What it means: The risk owner is accountable for the risk and decides on the response. The control owner is responsible for making sure a specific control is designed, operated and maintained. They may be different people.
What to understand: Clear, validated ownership is what turns a register entry into managed risk. Owners need the authority and resources to act. An owner without authority is ownership on paper only.
How it shows up: Questions ask who should approve a response, who should fix a failing control, or what is the MOST important outcome of assigning ownership, which is accountability.
Common confusion: Treating the control owner as accountable for the overall risk. The control owner runs a control. The risk owner answers for the risk.

3.A.3 Vendor/Supply Chain Risk ManagementManaging risk introduced by suppliers, service providers and their own suppliers.

What it means: This covers due diligence before engagement, security and risk clauses in contracts such as right to audit, service levels, breach notification and subcontractor controls, ongoing monitoring, and exit planning. It also covers risk from fourth parties and concentration on a single provider.
What to understand: Outsourcing a function does not outsource accountability for the risk. Assurance must be proportional to the vendor's criticality and its access to data or systems, and it must continue across the relationship, not only at onboarding.
How it shows up: A vendor is described with an assurance gap, such as no right to audit, a stale report or an unknown subcontractor, and you must choose the MOST important action or the best evidence of control.
Common confusion: Assuming a contract clause or a vendor's certificate settles the risk. Clauses create rights, and evidence of operating controls must still be obtained and reviewed.

3.A.4 Issues, Findings, Exceptions and Exemptions ManagementTracking problems and approved deviations so that none is quietly forgotten.

What it means: Issues and findings, for example from audits, assessments or incidents, are recorded with an owner, an action and a due date, and tracked to closure. Exceptions are approved, time-bound deviations from a requirement. Exemptions are longer-standing approved releases from a requirement, which should still be reviewed periodically.
What to understand: Every deviation should be risk-assessed, approved by someone with the right authority, supported by compensating controls where possible, recorded in the register and reviewed. Closing a finding requires validating the fix, not just receiving a note that it was done.
How it shows up: Questions ask what should happen when an exception expires, who should approve an exemption, or what is needed before a finding can be closed.
Common confusion: Treating approval as the end of the process. Approved exceptions still carry risk and need monitoring until they expire or are renewed.

3.B.1 Control Frameworks, Types, and StandardsThe catalogs and categories used to choose and describe controls.

What it means: Control frameworks and standards such as COBIT, ISO/IEC 27002, NIST SP 800-53 and the CIS Controls provide catalogs of controls. Controls are described by function, such as preventive, detective, corrective, deterrent, directive, recovery and compensating, and by nature, such as administrative, technical or physical.
What to understand: Frameworks give coverage and common language, but controls are still chosen to match the specific risk and environment. A balanced control set combines functions, because prevention alone fails silently when it is bypassed.
How it shows up: A control is described and you must classify it, or a control set is described and you must identify the missing function, for example no detective control.
Common confusion: Classifying by appearance rather than function. A log review is detective even if it is a manual, administrative activity.

3.B.2 Control Design, Selection, Implementation, and AnalysisChoosing controls that address the actual risk, and building them so they work.

What it means: Selection weighs how much risk a control reduces, its cost, its fit with the business process and how practical it is to operate. Design determines whether, if it runs as intended, the control would address the risk. Implementation puts it in place and makes sure it operates.
What to understand: A control should target the root cause or the scenario it is meant to address, and its cost should be proportionate to the risk reduction. Compensating controls are used when a primary control is not feasible, and they must address the same risk.
How it shows up: Questions ask what to consider FIRST when selecting a control, which is usually the risk it must address and its alignment with business objectives, or whether a proposed compensating control is adequate.
Common confusion: Picking the strongest control available rather than the one that is proportionate and fits the process. An overly burdensome control tends to be bypassed.

3.B.3 Control Testing MethodologiesHow to get evidence that controls are designed well and operating as intended.

What it means: Testing approaches include inquiry, observation, inspection of documents and records, and reperformance. Testing addresses design effectiveness, meaning the control would work if operated, and operating effectiveness, meaning it actually worked consistently over a period. Sampling is used when testing every instance is impractical.
What to understand: Evidence strength rises from inquiry, through observation and inspection, to reperformance. Inquiry alone is rarely enough. A control that is well designed but not operated consistently is still ineffective.
How it shows up: You must choose the testing method that gives the BEST evidence, or recognize that a test confirmed design but not operation.
Common confusion: Accepting a walkthrough or an interview as proof of operating effectiveness over a period.

3.C.1 Risk Action PlansThe concrete plan for carrying out a chosen risk response.

What it means: A risk action plan records what will be done, by whom, by when, with what resources, and how completion will be confirmed.
What to understand: The practitioner monitors progress and validates that responses were executed as planned and achieved the intended reduction. Delays and changes in scope must be escalated to the risk owner, not absorbed silently.
How it shows up: A plan is overdue or reported complete, and you must choose the next step, usually escalation to the owner or validation of the outcome.
Common confusion: Treating a completed task as reduced risk. A control can be deployed and still not reduce risk if it is misconfigured or bypassed.

3.C.2 Data Collection, Aggregation, Analysis, and ValidationMaking sure risk information is accurate, comparable and combined meaningfully.

What it means: Risk and control data comes from many sources, including logs, assessments, incidents, audits and metrics. It must be collected consistently, validated for accuracy and completeness, and aggregated so that related exposures are visible together.
What to understand: Aggregation can reveal risk that no single report shows, for example several medium risks that share one root cause or supplier. Unvalidated data produces confident reports that are wrong.
How it shows up: Questions ask what to do before relying on a data source, such as validating it, or what aggregation is MOST useful for, such as spotting concentrations and correlations.
Common confusion: Assuming automated data is accurate by default. Automated feeds still need checks for completeness, accuracy and timeliness.

3.C.3 Risk and Control Metrics (e.g., KRIs, KCIs, KPIs)Indicators that show risk, control effectiveness and performance changing over time.

What it means: Key risk indicators (KRIs) signal a change in exposure, ideally before a loss happens. Key control indicators (KCIs) show whether a control is working. Key performance indicators (KPIs) show whether a process or goal is being achieved.
What to understand: Good KRIs are relevant to significant risks, reliable, sensitive enough to move when risk changes, practical to measure, and tied to thresholds based on tolerance. Leading indicators are generally more valuable than lagging ones because they give time to act.
How it shows up: A list of metrics is given and you must choose the BEST KRI for a named risk, or say what to do when a threshold is breached.
Common confusion: Picking a KPI, such as training completion rate, when the question asks for a KRI, such as the trend in successful phishing click-throughs.

3.C.4 Risk and Control Monitoring TechniquesThe ongoing activities that show whether risk and controls are where they should be.

What it means: Techniques include continuous automated monitoring, periodic reviews, control self-assessment (CSA), trend analysis of indicators, and follow-up on incidents and findings.
What to understand: Monitoring frequency should match how fast the risk can change and how critical the control is. Self-assessment builds ownership in the first line but needs independent validation for high-risk areas.
How it shows up: Questions ask for the BEST technique in a context, such as high-volume transactions favoring continuous monitoring, or the main limitation of self-assessment.
Common confusion: Treating monitoring as the same thing as testing. Monitoring tracks ongoing indicators. Testing produces point-in-time evidence about a control.

3.C.5 Risk and Control Reporting Techniques (e.g., heatmap, scorecards, dashboards)Presenting risk information so each audience can make its decisions.

What it means: Heatmaps plot risks by likelihood and impact. Scorecards track performance against targets. Dashboards combine indicators and trends. Reports should be tailored to their audience, with boards needing aggregated, business-focused views and operational teams needing detail.
What to understand: The purpose of reporting is risk-based decision-making, so content, level of detail and frequency should follow what the audience must decide. Reports should show trends and appetite thresholds, not just current values.
How it shows up: Questions ask what to include in a board report, or why a technically accurate report failed to prompt action.
Common confusion: Sending the same detailed technical report to every audience. Senior leaders need business impact and exposure against appetite, not vulnerability counts.

3.C.6 Monitoring and Reporting of Emerging RisksSpotting and communicating risks that are new, changing or not yet well understood.

What it means: Emerging risks come from new technologies, changing threat actors, regulatory developments, market shifts and geopolitical events. They are identified through horizon scanning, threat intelligence and engagement with the business.
What to understand: Emerging risks should be reported even when they cannot yet be measured precisely, with clear statements about uncertainty, so that leaders can prepare. They should be fed into scenarios and the register as understanding improves.
How it shows up: A new technology or regulation is being adopted or announced, and you must choose the BEST first step, such as assessing its effect on existing scenarios and informing stakeholders.
Common confusion: Waiting until a risk can be quantified before reporting it, which removes the time leaders need to respond.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

Risk response options

Accept, avoid, mitigate, or transfer and share.

Remember
The risk owner chooses the option, guided by appetite and cost-benefit.

Tested as
The core decision type in Part A.

Trap
Assuming mitigation is always the answer.
Risk transfer

Moving part of the financial consequence to a third party, through insurance or a contract.

Remember
Accountability and reputational impact stay with the enterprise.

Tested as
Vendor and insurance scenarios.

Trap
Believing outsourcing removes responsibility for the risk.
Risk acceptance

Knowingly retaining a risk without further treatment.

Remember
It must be formally documented, approved by an owner with authority, kept in the register and reviewed.

Tested as
Questions about valid acceptance.

Trap
Removing accepted risks from the register.
KRI

A key risk indicator signals a change in risk exposure.

Remember
Leading indicators with thresholds tied to tolerance are the most valuable.

Tested as
Questions asking for the 'BEST KRI'.

Trap
Choosing a performance metric instead.
KCI

A key control indicator shows whether a control is operating effectively.

Remember
It measures the control, not the risk level.

Tested as
Control monitoring questions.

Trap
Calling it a KRI.
KPI

A key performance indicator measures how well a process or goal is being achieved.

Remember
It is usually lagging and tells you about performance, not exposure.

Tested as
Distinguishing metrics in multiple-choice options.

Trap
Using training completion as a measure of risk.
KRI selection criteria

Relevance to significant risks, reliability, sensitivity to change, and effort to measure.

Remember
A good KRI moves when the risk moves and is practical to collect.

Tested as
Choosing among candidate indicators.

Trap
Choosing the metric that is easiest to collect.
Design vs. operating effectiveness

Design asks whether the control would work if operated as intended. Operating effectiveness asks whether it actually did, consistently, over a period.

Remember
Both are needed, and good design alone proves nothing about operation.

Tested as
Testing and vendor assurance questions.

Trap
Accepting a walkthrough as proof of operation.
Evidence strength

Testing evidence ranges from inquiry, through observation and inspection, to reperformance.

Remember
Reperformance by the tester gives the strongest evidence, and inquiry alone the weakest.

Tested as
Questions asking for the BEST evidence.

Trap
Relying on a control owner's statement.
Compensating control

An alternative control used when the primary control is not feasible.

Remember
It must address the same risk to an acceptable level and be approved and documented.

Tested as
Exception and control-selection questions.

Trap
Accepting a control that addresses a different risk.
SOC 2 Type I vs. Type II

Type I reports on control design at a point in time. Type II reports on operating effectiveness over a period.

Remember
Type II gives stronger assurance that controls actually operate.

Tested as
Vendor assurance questions.

Trap
Treating a Type I report as evidence of ongoing operation.
Control self-assessment (CSA)

A first-line review of its own risks and controls.

Remember
It builds ownership but lacks independence, so high-risk areas need validation.

Tested as
Monitoring technique questions.

Trap
Treating CSA results as independent assurance.
Heatmap

A grid plotting risks by likelihood and impact.

Remember
It is good for showing relative position and concentration, but weak at showing trends or aggregation.

Tested as
Reporting format questions.

Trap
Using it as the only board report with no appetite thresholds or trend.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Accept vs. avoid vs. mitigate vs. transfer

Concept	Meaning	Key difference	Common trap
Accept	Knowingly retain the risk	No further treatment, but formal approval and ongoing review are required	Informal or undocumented acceptance
Avoid	Stop or do not start the activity that creates the risk	Removes the risk and also the benefit of the activity	Recommending it when the activity is central to strategy
Mitigate	Reduce likelihood or impact through controls	Risk remains, at a lower level	Applying it to risks already within appetite
Transfer or share	Move part of the financial consequence to another party	Accountability stays with the enterprise	Thinking insurance covers reputational damage

KRI vs. KCI vs. KPI

Concept	Meaning	Key difference	Common trap
KRI	Signals a change in risk exposure	Forward-looking and tied to tolerance thresholds	Choosing an activity count
KCI	Shows whether a control is working	Measures the control, not the exposure	Mislabeling it as a KRI
KPI	Shows whether a process or goal is being achieved	Measures performance and is often lagging	Using it as a proxy for risk

Preventive vs. detective vs. corrective vs. compensating controls

Concept	Meaning	Key difference	Common trap
Preventive	Stops an event from happening	Acts before the event	Relying on it alone, so bypasses go unnoticed
Detective	Identifies an event that has happened or is happening	Acts during or after the event	Classifying manual reviews as administrative only, not detective
Corrective	Limits damage and restores normal operation	Acts after detection	Confusing it with recovery of whole sites
Compensating	An alternative when the primary control is not feasible	Must address the same risk	Accepting any extra control as compensating

Inquiry vs. observation vs. inspection vs. reperformance

Concept	Meaning	Key difference	Common trap
Inquiry	Asking people how a control works	The weakest evidence on its own	Using it as the sole basis for a conclusion
Observation	Watching the control being performed	Point-in-time, and behavior may change while observed	Treating it as evidence over a period
Inspection	Examining documents, records or configurations	Gives documentary evidence of performance	Not checking that records are complete
Reperformance	The tester independently executes the control	The strongest evidence of effectiveness	Skipping it for high-risk controls to save time

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

Transfer removes the risk

What candidates pick
Outsource the process or buy insurance and treat the risk as resolved.

Why it looks right
The financial exposure moves, and someone else runs the activity.

Why it's wrong
Accountability, regulatory obligations and reputational damage stay with the enterprise. Ongoing vendor oversight is still required.

Clue to watch for The scenario mentions customer data, regulators or brand impact after outsourcing.
Always mitigate

What candidates pick
Add controls to every rated risk.

Why it looks right
Reducing risk sounds responsible.

Why it's wrong
If residual risk is already within appetite, or the control costs more than the loss it prevents, formal acceptance is the better decision.

Clue to watch for The question states that the risk is within appetite, or gives cost figures showing the control is not justified.
Performance metric as a KRI

What candidates pick
A metric like 'percentage of staff who completed training'.

Why it looks right
It is measurable, easy to collect and related to the topic.

Why it's wrong
It measures activity, not exposure. A KRI should move when the likelihood or impact of the risk changes.

Clue to watch for Ask yourself whether the risk could rise while this number stays perfect. If it could, it is not a good KRI.
Inquiry as evidence

What candidates pick
Interview the control owner to confirm the control works.

Why it looks right
The owner knows the control best, and it is quick.

Why it's wrong
Inquiry is the weakest evidence and does not show the control operated consistently. Inspection or reperformance is needed.

Clue to watch for The question asks for the BEST or MOST reliable evidence.
Same report for everyone

What candidates pick
Send the full technical risk report to the board.

Why it looks right
It is complete and transparent.

Why it's wrong
The board needs aggregated exposure against appetite, trends and decisions required. Technical detail hides the message.

Clue to watch for The audience is named as the board, executives or a risk committee.
Done equals effective

What candidates pick
Close the action plan because the owner reported the control as implemented.

Why it looks right
The task is complete and the deadline is met.

Why it's wrong
The practitioner must confirm that the response was executed and achieved the intended risk reduction.

Clue to watch for The only evidence of closure is the owner's statement.
Contract clause as assurance

What candidates pick
Rely on the vendor contract's security clause as evidence of control.

Why it looks right
The obligation is legally binding.

Why it's wrong
A clause creates a right or obligation. It is not evidence that controls are operating. Monitoring and assurance are still required.

Clue to watch for The vendor handles critical data and no recent independent assurance is mentioned.

Answer framework

For any Domain 3 scenario, use these steps to find the response, evidence or metric the exam expects.

Compare residual risk with appetite and tolerance to decide whether any response beyond formal acceptance is actually needed.
Identify the risk owner who must decide the response, and the control owner who must carry it out.
Weigh the response options on cost, benefit and fit with business objectives, remembering that transferring a risk never moves accountability for it.
Demand evidence that matches the claim, using inspection or reperformance for operating effectiveness rather than inquiry or a single walkthrough.
Monitor with indicators that move when risk moves, and report to each audience in the form it needs to make its decision.

Practice question

After assessment, a business owner decides to accept a risk whose residual rating falls within the enterprise's risk tolerance. What should the risk practitioner ensure happens next?

The risk is removed from the risk register because no treatment is planned Compensating controls are implemented before the acceptance takes effect The acceptance is formally documented and the risk stays in the register for periodic review Internal audit approves the acceptance decision

Show the answer

Answer C. Acceptance is a valid response when risk is within tolerance, but it must be documented with the owner's approval and kept in the register so changes in conditions are noticed. Removing the risk loses visibility of a known exposure. Compensating controls are not required when the risk is already acceptable. Internal audit should not make management decisions.

Want more like this? The CRISC practice test has questions for every domain.

Checklist

0 of 16

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Give this domain the largest share of your study time, because it carries almost a third of the exam. Start with Part A. Learn the four response options and practice deciding between them with appetite and cost information, then lock in the difference between risk ownership and control ownership. Vendor risk and the management of exceptions and exemptions follow naturally from there.

Move to Part B next. Learn control functions until you can classify any example, then study testing. The two most heavily tested ideas are the difference between design and operating effectiveness and the ranking of evidence strength.

Finish with Part C, and spend real time on KRIs, KCIs and KPIs. Candidates commonly underestimate how precise these distinctions are, so for each metric you meet ask: would this number change if the risk changed? Reporting is the other underestimated area. Practice deciding what the board needs compared with an operational manager.

Afterwards, do mixed sets across Domains 1 to 3 together. Most Domain 3 questions depend on the ownership logic from Domain 1 and the residual risk logic from Domain 2.

FAQ

Why is Domain 3 the heaviest?

It carries 32% of the exam under the current outline, which reflects how much of the risk practitioner's day-to-day work is responding, monitoring and reporting.

What is the difference between a KRI, a KCI and a KPI?

A KRI signals a change in risk exposure, a KCI shows whether a control is working, and a KPI shows whether a process or goal is being achieved. Exam options often mix all three.

Does buying cyber insurance transfer the risk?

It transfers part of the financial consequence. Accountability, regulatory duties and reputational damage remain with the enterprise, so the risk still needs to be managed.

Who approves risk acceptance?

The accountable risk owner or senior management with the authority to do so. The practitioner documents and advises, and must make sure the acceptance is recorded and reviewed.

What is the best evidence that a control works?

Evidence of operation over a period, obtained through inspection of records or reperformance by the tester. A conversation with the control owner is the weakest form.

How deep does vendor risk go?

Expect questions on due diligence, contract clauses such as right to audit and breach notification, ongoing assurance, fourth-party risk and exit planning, all framed around the enterprise keeping accountability.

What should a board risk report contain?

Aggregated exposure compared with appetite, significant changes and trends, emerging risks, and the decisions leadership needs to make. Detailed technical findings belong in operational reports.

How does Domain 3 connect to Domain 4?

Domain 4 describes the technology and security environment, such as change management, SDLC and data protection, where many of the controls designed and tested here actually operate.

Related domains

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Overview

How it's tested

Response selection

Evidence strength

Right metric, right audience

Subtopics 13

High-yield concepts

Risk response options

Risk transfer

Risk acceptance

KRI

KCI

KPI

KRI selection criteria

Design vs. operating effectiveness

Evidence strength

Compensating control

SOC 2 Type I vs. Type II

Control self-assessment (CSA)

Heatmap

Side by side

Accept vs. avoid vs. mitigate vs. transfer

KRI vs. KCI vs. KPI

Preventive vs. detective vs. corrective vs. compensating controls

Inquiry vs. observation vs. inspection vs. reperformance

Exam traps

Transfer removes the risk

Always mitigate

Performance metric as a KRI

Inquiry as evidence

Same report for everyone

Done equals effective

Contract clause as assurance