CRISC Certified in Risk and Information Systems ControlInformation Technology and SecurityMedium
A risk manager is conducting a qualitative risk assessment for a new product launch. The team identifies a risk event: 'Failure of a key third-party API leading to service disruption.' They assess the likelihood as 'Medium' and the impact as 'High'. Based on this, what is the MOST appropriate initial risk rating?
- AMedium
- BHigh
- CCritical
- DLow
Show answer & explanationAnswer & explanation
Correct answer: B. High
In qualitative risk assessment, a 'Medium' likelihood combined with 'High' impact typically results in a 'High' risk rating. The specific matrix varies, but this combination generally indicates significant concern.
Why the other options are wrong
- A. Medium risk would typically result from medium likelihood and medium impact, or low/high combinations.
- C. Critical risk is usually reserved for events with both high likelihood and high impact, or catastrophic impact regardless of likelihood.
- D. Low risk would typically result from low likelihood and low impact.
Qualitative Risk Assessment
A method of risk assessment that uses descriptive terms (e.g., low, medium, high) to evaluate the likelihood and impact of risks, rather than numerical values.
- Uses descriptive scales for likelihood and impact.
- Often presented in a risk matrix.
- Provides a quick, high-level overview of risks.
Memory trick: L-I-R: 'Likelihood', 'Impact', 'Rating' in a 'Grid'.