IT Risk Assessment Techniques Flashcards

Which risk assessment scope consideration is UNIQUE to IT environments compared to general business risk?

Answer: Interdependencies between interconnected systems and platforms

IT risk assessments must uniquely account for cascading failures across interconnected systems, which is more complex than assessing independent business units.

A risk scenario is MOST useful in risk assessment because it:

Answer: Provides a realistic narrative linking threats, vulnerabilities, and business impacts

Risk scenarios connect threat actors, vulnerabilities, and business impacts into a coherent story that helps stakeholders understand and prioritize risks.

When conducting a business impact analysis (BIA), which output is MOST directly used in IT risk assessment?

Answer: Recovery time objectives and critical process dependencies

RTOs and critical process dependencies from a BIA directly inform which IT risks have the highest business impact, guiding prioritization.

The inherent risk of an IT process is BEST defined as:

Answer: The risk level before any controls are applied

Inherent risk is the raw, unmitigated risk level of an activity before any controls or countermeasures are taken into account.

Which approach BEST ensures that a risk assessment remains relevant over time?

Answer: Periodic reassessment triggered by significant changes in the environment

Risk assessments must be refreshed whenever significant changes occur (new systems, threats, regulations) to remain accurate and actionable.

Risk scenarios in CRISC are aligned with COBIT process goals PRIMARILY to:

Answer: Ensure IT risks are mapped to business processes and objectives

Aligning risk scenarios with COBIT process goals ensures that IT risks are evaluated in terms of their impact on business processes and strategic objectives.