CRISC Certified in Risk and Information Systems ControlIT Risk AssessmentMedium
A healthcare organization is conducting an IT risk assessment for its new patient portal. During the risk identification phase, the team uses a systematic approach to uncover potential threats and vulnerabilities. Which of the following techniques is BEST suited for identifying both known and unknown risks by breaking down the system into its components and analyzing potential failure points?
- ADelphi technique
- BStructured walkthroughs
- CFault tree analysis
- DBrainstorming sessions
Show answer & explanationAnswer & explanation
Correct answer: C. Fault tree analysis
Fault tree analysis is a top-down, deductive failure analysis that identifies potential causes for system failures, making it excellent for breaking down a system and finding both known and potentially unknown failure points. While other options identify risks, fault tree analysis is specifically designed for this systematic breakdown.
Why the other options are wrong
- A. The Delphi technique is used for reaching consensus among experts and is less about systematic system breakdown for risk identification.
- B. Structured walkthroughs review documentation or code for errors but are not primarily a technique for identifying system-wide failure points and their root causes.
- D. Brainstorming is good for generating ideas but may not be systematic enough to uncover all failure points and is prone to groupthink.
Fault Tree Analysis (FTA)
A top-down, deductive failure analysis method in which an undesired state of a system is analyzed using Boolean logic to combine a series of lower-level events.
- Identifies root causes of system failures.
- Uses graphical representation (tree structure).
- Helps quantify probability of system failure.
Memory trick: Risk ID: Find the Fails, Brainstorm the Bumps, Delphi the Decisions, Walk the Work.