The most important factors to consider when evaluating a number of potential controls for treating risk are the residual risk and the cost of control. Residual risk is the risk that remains after the implementation of the controls. Cost of control is the amount of resources and efforts required to implement and maintain the controls. By considering the residual risk and the cost of control, the organization can optimize the balance between the risk exposure and the control investment, and choose the most effective and efficient controls.
Risk appetite and control efficiency, inherent risk and control effectiveness, and risk tolerance and control complexity are other possible factors, but they are not as important as residual risk and cost of control.
References = ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, question 8; CRISC Review Manual, 6th Edition, page 97.

Section: Volume B
Explanation:
The result of risk analysis process is being communicated to relevant stakeholders. The steps that are involved in communication are:
* The results should be reported in terms and formats that are useful to support business decisions.
* Coordinate additional risk analysis activity as required by decision makers, like report rejection and scope adjustment
* Communicate the risk-return context clearly, which include probabilities of loss and/or gain, ranges, and confidence levels (if possible) that enable management to balance risk-return.
* Identify the negative impacts of events that drive response decisions as well as positive impacts of events that represent opportunities which should channel back into the strategy and objective setting process.
* Provide decision makers with an understanding of worst-case and most probable scenarios, due diligence exposures and significant reputation, legal or regulatory considerations.
Incorrect Answers:
C: Communicate the negative impacts of events that drive response decisions as well as positive impacts of events that represent opportunities which should channel back into the strategy and objective setting process, for effective communication. Only negative impacts are not considered alone.

Section: Volume C
Explanation
Explanation:
Low-impact, low-probability risks can be added to the low priority risk watch list.
Incorrect Answers:
A: These risks are not dismissed; they are still documented on the low priority risk watch list.
B: While these risks may be accepted, they should be documented on the low priority risk watch list. This list will be periodically reviewed and the status of the risks may change.
D: Not every risk demands a risk response, so this choice is incorrect.