Certified in Risk and Information Systems Control (CRISC) Practice Test

In the realm of risk management, controls are typically categorized into a framework that highlights their distinct purposes and functions. The correct answer indicates that there are six recognized types of controls often outlined in risk management practices. These types generally include:

1. **Preventive Controls**: Aimed at preventing potential risks from materializing. They are proactive measures designed to reduce the likelihood of an incident occurring.

2. **Detective Controls**: These controls are designed to identify and detect occurrences of risk events that have already taken place. They provide feedback and insights into risk mitigation's effectiveness.

3. **Corrective Controls**: When a risk event has occurred, corrective controls are implemented to mitigate damage or to restore the affected systems or processes to an acceptable state.

4. **Compensatory Controls**: These are alternative measures put in place to satisfy the requirement of a primary control that may be unimplemented or insufficient. They serve as substitutes in the risk management strategy.

5. **Directive Controls**: These controls are intended to guide and inform employees on their behaviors and actions within an organization with respect to security and compliance standards.

6. **Recovery Controls**: Focused on recovering from disruptive events, these controls ensure that organizations can quickly bounce back after an