CRISC Certified in Risk and Information Systems ControlIT Risk AssessmentMedium
A multinational corporation is updating its IT risk register. The current register includes entries for 'Data Breach,' 'System Outage,' and 'Malware Infection.' The CRISC professional observes that these entries are too broad and lack specific details for effective management. To improve the risk register, which of the following actions should the CRISC professional prioritize?
- ABreak down broad risks into more granular, actionable risk scenarios.
- BImplement a new risk scoring model with more granular likelihood and impact scales.
- CAdd a column for the risk owner's contact information for each entry.
- DConduct a comprehensive review of all existing controls for each risk entry.
Show answer & explanationAnswer & explanation
Correct answer: A. Break down broad risks into more granular, actionable risk scenarios.
Broad risk statements like 'Data Breach' are difficult to manage because they don't specify the 'who, what, where, when, why, and how.' Breaking them down into more granular, actionable risk scenarios (e.g., 'Unauthorized access to customer PII via compromised web server') provides the necessary detail for effective analysis, control selection, and response planning.
Why the other options are wrong
- B. A new scoring model won't make broad risks more actionable; it will just score them differently. Specificity is needed first.
- C. While helpful, contact information doesn't address the fundamental lack of detail in the risk description itself.
- D. Reviewing controls is part of risk treatment, but it's premature if the risks themselves are not clearly defined and understood.
Actionable Risk Scenarios
Specific, detailed descriptions of potential risk events that clearly define the threat, asset, vulnerability, and impact, enabling effective analysis and response.
- Follow a 'cause-event-impact' structure.
- Are measurable and testable.
- Provide clarity for control selection.
Memory trick: To make risks 'Actionable,' turn 'Broad' into 'Specific' stories.