easyMultiple Choice
CRISC Practice Question: Conducting an IT risk assessment for the first…
A company is conducting an IT risk assessment for the first time. Which of the following should be the FIRST step?
⚠ Common exam trap
The trap here is that candidates often jump straight to identifying assets (Option A) because it seems like the most tangible first step, but they fail to recognize that without establishing context, the asset inventory may be scoped incorrectly or lack business alignment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Establish the risk assessment context
Before any risk assessment activities can begin, the organization must establish the context—defining the scope, risk appetite, criteria for risk evaluation, and the business objectives the assessment supports. Without this foundational step, subsequent identification of assets, threat analysis, or control implementation would lack alignment with business goals and could produce irrelevant or misleading results. This aligns with the ISACA Risk IT framework and the CRISC domain of IT Risk Assessment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Identify all IT assets
Why it's wrong here
Identifying assets is necessary groundwork, but risk assessment first requires establishing scope and objectives so the assessment aligns with business context. It tempts because asset inventory underpins later risk identification, and it would be the correct initial step once scope and methodology are agreed.
- ✓
Establish the risk assessment context
Why this is correct
Establishing the risk assessment context first defines scope, objectives, risk criteria and stakeholder expectations before any identification or analysis begins, satisfying the stem's requirement for a first step in an initial assessment. Without agreed context, subsequent risk identification lacks boundaries and consistent evaluation criteria, producing unreliable results.
- ✗
Analyze the likelihood and impact of threats
Why it's wrong here
Analysing likelihood and impact presupposes that risks and assets have already been identified; without that input there is nothing to analyse. It tempts because likelihood-impact analysis is the core quantitative technique of risk assessment, and it is correct once the risk register and scope exist.
- ✗
Implement mitigating controls
Why it's wrong here
Implementing controls is a risk treatment activity that follows assessment; doing it first means controls are chosen without knowing which risks matter. It tempts because mitigation is the visible outcome stakeholders expect, but it is correct only after risks have been identified, analysed and evaluated.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 1,062 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.