CRISC Cheat Sheet

#	Domain	Weight	Questions	Practice
2.0	IT Risk Assessment Risk management questions test risk identification, qualitative vs quantitative analysis, risk response strategies (avoid, transfer, mitigate, accept), and risk registers.	—	130	Practice →

Domain

Weight

Questions

Practice

2.0

IT Risk Assessment

Risk management questions test risk identification, qualitative vs quantitative analysis, risk response strategies (avoid, transfer, mitigate, accept), and risk registers.

—

130

Practice →

Domain Quick Reference

2.0IT Risk Assessment

Risk management questions test risk identification, qualitative vs quantitative analysis, risk response strategies (avoid, transfer, mitigate, accept), and risk registers.

Key concepts

✓Risk identification techniques: brainstorming, SWOT, Delphi technique, and historical data review.
✓Qualitative analysis: probability-impact matrix, risk categorisation, and urgency assessment.
✓Quantitative analysis: EMV (Expected Monetary Value), Monte Carlo simulation, and sensitivity analysis.
✓Risk response strategies and when each is appropriate based on impact and probability.

Watch out for

⚠Confusing risk avoidance (eliminate the cause) with risk transfer (shift consequence to another party).
⚠Treating a risk with low probability and high impact the same as one with high probability and low impact.
⚠Forgetting that residual risk remains after mitigation and must be accepted or further treated.
⚠Selecting risk acceptance for a high-impact, high-probability risk — acceptance is for low-impact or unavoidable risks.

Exam Day Reminders

→Read every question stem fully — look for qualifiers like 'MOST likely,' 'BEST,' or 'EXCEPT.'

→Flag uncertain questions and come back — don't waste time on one question.

→Eliminate obviously wrong options first, then choose between remaining ones.

→Trust your first instinct unless you have a specific reason to change.

→For CRISC, scenarios typically have one clearly best answer — look for the option that matches the specific constraints in the question.

#	Domain	Weight	Questions	Practice
2.0	IT Risk Assessment Risk management questions test risk identification, qualitative vs quantitative analysis, risk response strategies (avoid, transfer, mitigate, accept), and risk registers.	—	130	Practice →

Domain

Weight

Questions

Practice

2.0

IT Risk Assessment

Risk management questions test risk identification, qualitative vs quantitative analysis, risk response strategies (avoid, transfer, mitigate, accept), and risk registers.

—

130

Practice →

Domain Quick Reference

2.0IT Risk Assessment

Risk management questions test risk identification, qualitative vs quantitative analysis, risk response strategies (avoid, transfer, mitigate, accept), and risk registers.

Key concepts

✓Risk identification techniques: brainstorming, SWOT, Delphi technique, and historical data review.
✓Qualitative analysis: probability-impact matrix, risk categorisation, and urgency assessment.
✓Quantitative analysis: EMV (Expected Monetary Value), Monte Carlo simulation, and sensitivity analysis.
✓Risk response strategies and when each is appropriate based on impact and probability.

Watch out for

⚠Confusing risk avoidance (eliminate the cause) with risk transfer (shift consequence to another party).
⚠Treating a risk with low probability and high impact the same as one with high probability and low impact.
⚠Forgetting that residual risk remains after mitigation and must be accepted or further treated.
⚠Selecting risk acceptance for a high-impact, high-probability risk — acceptance is for low-impact or unavoidable risks.

Exam Day Reminders

→Read every question stem fully — look for qualifiers like 'MOST likely,' 'BEST,' or 'EXCEPT.'

→Flag uncertain questions and come back — don't waste time on one question.

→Eliminate obviously wrong options first, then choose between remaining ones.

→Trust your first instinct unless you have a specific reason to change.

→For CRISC, scenarios typically have one clearly best answer — look for the option that matches the specific constraints in the question.

CRISC Exam Blueprint — At a Glance

Domain Quick Reference

2.0IT Risk Assessment

Exam Day Reminders

More CRISC resources

CRISC Cheat Sheet

CRISC Exam Blueprint — At a Glance

Domain Quick Reference

2.0IT Risk Assessment

Exam Day Reminders

More CRISC resources