Which risk state reflects the situation at a moment in time, including actions already taken but not future actions?

• A. Detection risk
• B. Inherent risk
• C. ROI
• D. Current risk

Answer: (D)

Risk is a moving target, described as different states at a given time. The current risk state is the snapshot of what the organization faces right now, after actions and controls that have already been put in place, but before any future actions are enacted. That’s exactly what the question is asking for: a moment-in-time view that accounts for what’s been done so far but not what will be done next. Inherent risk looks at risk before any controls, so it wouldn’t reflect actions already taken. ROI isn’t about risk levels, and detection risk is an audit-focused concept, not the enterprise risk state described.