IT Risk Assessment Techniques Flashcards
6 cards from real CRISC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 IT Risk Assessment Techniques flashcards as text
The Delphi technique is MOST useful in risk assessment for which purpose?
Answer: Reaching consensus among experts without groupthink bias
The Delphi technique uses structured, anonymous rounds of expert input to build consensus on risk assessments while minimizing groupthink.
When assessing the impact of a risk, a CRISC practitioner should consider which dimension FIRST?
Answer: Business impact rather than technical impact
Business impact (financial, reputational, operational) should be the primary consideration because it directly connects risk to organizational objectives.
Which risk assessment output BEST supports prioritization of risk remediation efforts?
Answer: A risk heat map showing likelihood vs. impact
A risk heat map visually plots risks by likelihood and impact, making it easy to prioritize the highest-priority risks for remediation.
In IT risk assessment, exposure factor (EF) represents:
Answer: The percentage of an asset's value lost if a threat event occurs
The exposure factor is the percentage of an asset's value that would be lost in a single threat event, used to calculate Single Loss Expectancy.
A risk assessment that evaluates risks AFTER controls are applied is measuring:
Answer: Residual risk
Residual risk is the level of risk remaining after controls have been implemented, representing the organization's actual remaining exposure.
Which factor should be considered when determining the frequency component of a risk assessment?
Answer: Historical incident data and threat intelligence
Frequency (likelihood) is best estimated using historical incident records and current threat intelligence relevant to the organization's environment.