CRISC: Certified in Risk and Information Systems ControlDemo

By Isaca · Question Mode

QuestionQ1170

Risk Assessment

An organization is considering acquiring a new line of business and wants to create new IT risk scenarios to inform its decisions. Which of the following would provide the MOST value for the new risk scenarios?

  • A Audit findings
  • B Expected losses
  • C Cost-benefit analysis
  • D Organizational threats
Explanation

Organizational threats identify the sources and types of adverse events that could affect the acquired line of business. They therefore provide the essential context for developing relevant IT risk scenarios. Expected losses and cost-benefit analysis are used to evaluate risks or responses after scenarios have been defined, while audit findings are narrower historical assurance evidence.

Community Discussion

No comments yet. Be the first to start the discussion!