Exam CRISC Topic 9 Question 791 Discussion

The most important factors to consider when evaluating a number of potential controls for treating risk are the residual risk and the cost of control. Residual risk is the risk that remains after the implementation of the controls. Cost of control is the amount of resources and efforts required to implement and maintain the controls. By considering the residual risk and the cost of control, the organization can optimize the balance between the risk exposure and the control investment, and choose the most effective and efficient controls.
Risk appetite and control efficiency, inherent risk and control effectiveness, and risk tolerance and control complexity are other possible factors, but they are not as important as residual risk and cost of control.
References = ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, question 8; CRISC Review Manual, 6th Edition, page 97.