easyMultiple ChoiceObjective-mapped
CRISC Practice Question: Conducting an IT risk assessment for the first…
A company is conducting an IT risk assessment for the first time. Which of the following should be the FIRST step?
⚠ Common exam trap
The trap here is that candidates often jump straight to identifying assets (Option A) because it seems like the most tangible first step, but they fail to recognize that without establishing context, the asset inventory may be scoped incorrectly or lack business alignment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Establish the risk assessment context
Before any risk assessment activities can begin, the organization must establish the context—defining the scope, risk appetite, criteria for risk evaluation, and the business objectives the assessment supports. Without this foundational step, subsequent identification of assets, threat analysis, or control implementation would lack alignment with business goals and could produce irrelevant or misleading results. This aligns with the ISACA Risk IT framework and the CRISC domain of IT Risk Assessment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Identify all IT assets
Why it's wrong here
Risk identification should occur after the context is established.
- ✓
Establish the risk assessment context
Why this is correct
Establishing context is the initial step in the risk assessment process.
- ✗
Analyze the likelihood and impact of threats
Why it's wrong here
Risk analysis is performed after risk identification.
- ✗
Implement mitigating controls
Why it's wrong here
Controls are implemented after risk evaluation and treatment.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 983 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.