CRISC Certified in Risk and Information Systems ControlIT Risk AssessmentMedium
A software development company is migrating its code repositories to a new platform. The risk team is conducting a qualitative risk assessment. To ensure consistency and objectivity across different assessors, which of the following practices is MOST important for evaluating risk likelihood and impact?
- ADeveloping clear, predefined criteria and descriptors for each rating level.
- BFocusing solely on the technical aspects of the migration, ignoring business context.
- CAllowing each assessor to use their individual interpretation of terms.
- DUsing a simple 'high/medium/low' scale without further definition.
Show answer & explanationAnswer & explanation
Correct answer: A. Developing clear, predefined criteria and descriptors for each rating level.
To ensure consistency and objectivity in qualitative risk assessments, it is critical to define what 'High', 'Medium', and 'Low' (or any other scale) mean for both likelihood and impact. Clear, predefined criteria provide a common understanding and reduce subjective interpretation among assessors.
Why the other options are wrong
- B. Ignoring business context would result in an incomplete and inaccurate risk assessment, as business impact is a key component of risk.
- C. Allowing individual interpretation directly undermines consistency and objectivity, leading to disparate risk ratings.
- D. A simple 'high/medium/low' scale without definitions is inherently subjective and will lead to inconsistency and lack of objectivity.
Qualitative Risk Scale Consistency
Ensuring uniform interpretation and application of qualitative ratings (e.g., High, Medium, Low) for likelihood and impact across all risk assessors.
- Achieved through clear definitions and criteria.
- Reduces subjectivity and bias.
- Essential for comparable and reliable risk assessments.
Memory trick: Qualitative Quality: Define, Don't Deviate, Document.