CISM Information Security Risk Management Practice Question
A healthcare organization is conducting a risk assessment for a new telehealth platform that will process protected health information. The assessment team proposes using a qualitative approach because of tight deadlines. Which of the following is the MOST significant limitation of relying solely on qualitative risk assessment for this initiative?
⚠ Common exam trap
Many candidates confuse the speed advantage of qualitative assessment with its analytical limitations, when the real issue is subjectivity and lack of comparability.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It may produce inconsistent ratings that are difficult to compare across systems or justify to regulators
Qualitative risk assessment relies on subjective judgment and descriptive scales, which can lead to inconsistent ratings across assessors and make it difficult to compare risks or provide defensible evidence to regulators. For a telehealth platform processing protected health information, the organization needs consistent, auditable risk prioritization, so the lack of repeatability and comparability is the most significant limitation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It takes significantly longer to complete than a quantitative assessment
Why it's wrong here
Qualitative assessments are typically faster and less resource-intensive than quantitative ones, which require data collection, modeling, and statistical expertise. The scenario states the team chose qualitative due to tight deadlines, so speed is an advantage, not a limitation. Claiming it takes longer contradicts the nature of qualitative methods and the reason for selecting them here.
- ✗
It cannot incorporate input from clinical staff who understand patient workflows
Why it's wrong here
Qualitative assessments often rely heavily on stakeholder workshops and interviews, so they can and typically do incorporate clinical staff input. The limitation is not about excluding subject matter experts but about the precision and comparability of the resulting risk ratings. Clinical workflow insight is valuable and can be captured in qualitative methods, so this is not the most significant limitation.
- ✗
It requires specialized statistical software that the organization may not have licensed
Why it's wrong here
Qualitative assessments generally do not require specialized statistical software; they often use spreadsheets, risk matrices, and facilitated discussions. The absence of statistical tools is more characteristic of a barrier to quantitative analysis. Therefore, this is not a limitation of the qualitative approach itself and does not represent the most significant concern for the telehealth risk assessment.
- ✓
It may produce inconsistent ratings that are difficult to compare across systems or justify to regulators
Why this is correct
Qualitative risk assessments use descriptive scales such as high, medium, and low, which depend on subjective judgment and can vary between assessors and sessions. This makes it hard to compare risks across different systems consistently or to provide quantitative evidence to regulators. For a telehealth platform handling protected health information, defensible and repeatable risk prioritization is critical, so this limitation is the most significant.
Go deeper
Related to this question
About these practice questions
One of 924 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.