An IS auditor is reviewing an organization's risk assessment process. The organization uses a qualitative risk assessment methodology. The auditor notes that risk scenarios are inconsistently defined, and the criteria for rating likelihood and impact vary significantly among different departments. What is the MOST significant implication of this observation?
- AThe risk register will contain an excessive number of low-priority risks.
- BThe risk assessment process will take an unnecessarily long time to complete.
- CThe organization's overall risk posture cannot be accurately aggregated or compared.
- DStakeholders will struggle to understand the technical details of the identified risks.
Show answer & explanationAnswer & explanation
Correct answer: C. The organization's overall risk posture cannot be accurately aggregated or compared.
Inconsistent definitions and varying criteria for likelihood and impact mean that different departments are essentially speaking different 'risk languages.' This makes it impossible to accurately compare risks across departments or aggregate them to form a reliable, consolidated view of the organization's overall risk posture, which is essential for effective enterprise risk management.
Why the other options are wrong
- A. While possible, this is a symptom of inconsistency, not the primary strategic implication of varying criteria.
- B. Process duration is an operational issue, less significant than the inability to accurately manage enterprise-wide risk.
- D. This relates to communication of risk, but the fundamental problem is the *assessment* itself being inconsistent, making the communication unreliable.
Qualitative Risk Assessment Consistency
Consistent application of a qualitative risk assessment methodology ensures that risk scenarios, likelihood, and impact are evaluated uniformly across an organization, enabling accurate comparison and aggregation of risks.
- Uses descriptive categories (e.g., High, Medium, Low).
- Requires clear definitions for categories and criteria.
- Inconsistency undermines comparability and aggregation.
Memory trick: Consistent Criteria Creates Clear Comparisons.