CRISC: Certified in Risk and Information Systems ControlDemo

Question

A risk practitioner has filled the risk register with industry-based generic risk scenarios for further assessment by risk owners. Which of the following is the GREATEST concern with this approach?

A Risk scenarios in the generic list may not help in building risk awareness
B Risk scenarios that are not relevant to the organization may be assessed
C Developing complex risk scenarios using the generic list will be difficult
D Relevant risk scenarios that do not appear in the generic list may not be assessed

Explanation

Generic risk scenarios must be tailored and supplemented to reflect the organization’s actual business objectives, context, and risks. Relying on a generic list alone can leave organization-specific relevant scenarios unidentified and therefore unassessed, creating an incomplete risk profile.

Learn more

IT Scenario Analysis in Enterprise Risk Management

CRISC: Certified in Risk and Information Systems ControlDemo

AstroTutor

Notes

Readiness

QuestionQ1693

Community Discussion