What is the effect on risk scores when mitigating controls are in place?

• A. Risk scores will automatically decrease for the risk statement's risks since there are now mitigating controls
• B. Risk scores will automatically increase
• C. No change to risk scores
• D. Risk scores are permanently fixed

Answer: (A)

Mitigating controls reduce the residual risk you’re measuring. In IRM, the risk score is calculated after considering controls that are in place, meaning the system updates the score to reflect the lower exposure when controls are effective. When mitigating controls exist for a risk, the inherent risk is dampened by the control effectiveness, so the residual risk—and thus the risk score—drops automatically for the related risk statement. This automatic recalculation ensures scores represent the current risk posture; if controls aren’t in place or aren’t effective, the score wouldn’t decrease.