CISM Information Security Risk Management Practice Question
A company is evaluating its risk management process. The CISM notices that risks are being assessed based on qualitative scales (low, medium, high) but decisions require quantitative data. What is the most effective action to improve the process?
⚠ Common exam trap
Candidates often assume 'quantitative' is always superior, ignoring the practical need for a hybrid approach that balances qualitative speed with quantitative rigor for decision-making.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a hybrid approach that includes both qualitative and quantitative assessments.
A hybrid approach (Option B) is most effective because it leverages qualitative scales for initial, rapid risk identification and prioritization, while quantitative data (e.g., ALE, SLE, ARO) provides the monetary rigor needed for cost-benefit analysis and management decisions. This aligns with ISACA's guidance that risk assessment should be tailored to the decision context, not purely one method.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Switch to a fully quantitative risk assessment methodology.
Why it's wrong here
Quantitative alone may be too complex and miss intangible factors.
- ✓
Use a hybrid approach that includes both qualitative and quantitative assessments.
Why this is correct
Provides comprehensive risk information for decision-making.
- ✗
Replace qualitative scales with precise monetary values.
Why it's wrong here
This is a form of quantitative but may not be practical for all risks.
- ✗
Continue using qualitative method since it is simpler.
Why it's wrong here
Does not meet the need for quantitative data for decisions.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 871-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.