A county risk owner wants to mark a privacy breach risk Mitigated after drafting three remediation tickets. What must happen first in the risk response lifecycle?
Select an answer to reveal the explanation.
Short Explanation
Mitigated is a finish line, not a sticky note. You still need the response tasks actually done—and residual back inside tolerance—before flipping that status. Drafting tickets without finishing them is just hoping the risk goes away.
Full Explanation
A county risk owner who wants to mark a privacy breach risk Mitigated after only drafting three remediation tickets must first create response tasks, track them to completion, and confirm residual is within tolerance before claiming mitigated status. Draft tickets are intent, not completed treatment for resident privacy exposure. Archiving the risk statement library entry so no new instances can be generated fails by concept because library maintenance is unrelated to completing response on an active risk. Raising inherent to match residual before any status change fails by concept because fabricating inherent equality does not prove mitigation. Transferring ownership to Internal Audit so auditors close the risk without operational follow-through fails by concept because auditors provide assurance; they do not own operational remediation closure. Exam caveat: CIS-RC requires completed response tasks and residual within tolerance before Mitigated status. Operational check: convert drafts into owned response tasks, complete and evidence them, reassess residual against tolerance, and only then set the privacy risk to Mitigated. In civic IRM programs, retain configuration and decision evidence so examiners can reconstruct why this design supports public services.