IIA-CRMA Exam - Topic 1 Question 109 Discussion

Actual exam question for IIA's IIA-CRMA exam

Question #: 109
Topic #: 1

[All IIA-CRMA Questions]

What is the purpose of a secondary control?

AIt replaces primary controls that are either ineffective or cannot fully mitigate a risk.

BIt partially reduces the residual risk level when a key control does not operate effectively.

Clt combines with other controls to help reduce significant risk exposures to an acceptable level.

DIt helps to ensure the completeness and accuracy of automated controls in a system environment.

Show Suggested Answer

Suggested Answer: C

by Mammie at Nov 25, 2025, 08:14 PM

Limited Time Offer

25%

Off

Get Premium IIA-CRMA Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Leota

2 hours ago

I think it's B. It makes sense to reduce residual risk.

upvoted 0 times

...

Trinidad

5 days ago

I thought they just supported primary controls, not replaced them.

upvoted 0 times

...

Starr

10 days ago

They definitely help reduce residual risks!

upvoted 0 times

...

Margart

29 days ago

Wait, are they really that important?

upvoted 0 times

...

Teddy

1 month ago

Totally agree, they’re essential for risk management!

upvoted 0 times

...

Anna

1 month ago

Option B makes the most sense to me. Secondary controls are there as a backup when the main ones don't cut it.

upvoted 0 times

...

Avery

1 month ago

Haha, I bet the exam writers had a field day coming up with these options. Tricky stuff!

upvoted 0 times

...

Irving

2 months ago

D sounds like the right choice. Secondary controls ensure automated controls are working properly.

upvoted 0 times

...

Pamella

2 months ago

I vaguely recall something about secondary controls ensuring accuracy in automated systems, but I can't remember if that's their primary function.

upvoted 0 times

...

Veta

2 months ago

I feel like secondary controls work alongside primary ones to manage risk, which makes me lean towards option C, but I could be wrong.

upvoted 0 times

...

Jolanda

2 months ago

I remember practicing a question that talked about how secondary controls can reduce residual risk, so I think option B might be correct.

upvoted 0 times

...

Curtis

2 months ago

I think secondary controls are meant to help when primary controls fail, but I'm not sure if that's the main purpose.

upvoted 0 times

...

Devorah

3 months ago

I'm a bit confused by the wording of these options. I'm going to re-read them carefully, but I think C makes the most sense to me based on my understanding of how secondary controls work.

upvoted 0 times

...

Vallie

3 months ago

The key here is that a secondary control is meant to supplement the primary controls, not replace them. So I'm confident that C is the right answer.

upvoted 0 times

...

Herman

3 months ago

Okay, let me think this through. A secondary control is meant to provide additional mitigation when a primary control isn't fully effective. So I'm going to go with B on this one.

upvoted 0 times

...