The Calculated Risk Score adjustments are driven by which factor besides the Inherent and Residual risk scores?

• A. Audit Scores
• B. Attestation Score
• C. Configuration Test Score
• D. Control and Indicator Failure Factors

Answer: (D)

The main idea is that risk scoring in IRM isn’t just about what could inherently happen or what remains after applying controls; it also includes a specific adjustment for how well the controls and their monitoring indicators actually perform. This adjustment is captured by the Control and Indicator Failure Factors. When tests, audits, or attestations reveal that a control is failing or an indicator is not meeting its target, these failures push the risk score upward to reflect real-world effectiveness, not just theoretical risk. The other inputs (like audit-related scores or configuration test results) signal issues, but the adjustment itself is the failures in controls and indicators, which is why this option is the best choice.