CRISC IT Risk Assessment Practice Question

A financial services firm is defining the scope of its annual IT risk assessment. The board has asked the risk team to ensure the assessment covers both internal and external factors that could affect the confidentiality of customer data. Which TWO activities should the team include to meet this expectation? (Choose two.)

⚠ Common exam trap

The trap here is equating a previous year's scope with a current one, or assuming internal systems alone represent the full confidentiality exposure.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Inventory and classify all internal systems and data repositories that store or process customer information.

A complete assessment scope requires knowing what must be protected and what could threaten it. Inventorying and classifying internal data repositories establishes the internal view, while mapping external threat sources and third-party attack surface establishes the external view. Prior findings, internal-only limits, and opinion surveys do not deliver this coverage, so they cannot fulfill the board's request.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Review last year's audit findings and assume the same scope remains valid.
Why it's wrong here
Reusing a prior scope assumes the environment has not changed, but new systems, vendors, and data flows appear constantly. This approach can miss newly introduced confidentiality risks and gives a false sense of completeness. While prior findings are useful input, relying on them alone does not satisfy the requirement to cover current internal and external factors.
✗
Limit the assessment to systems managed by the internal IT department.
Why it's wrong here
Restricting scope to internally managed systems excludes cloud services, vendor platforms, and shadow IT that often hold customer data. Those external components are precisely where confidentiality breaches frequently originate. This limitation would leave significant exposure unexamined and fails to meet the board's request to cover external factors, so it is not appropriate.
✓
Inventory and classify all internal systems and data repositories that store or process customer information.
Why this is correct
An accurate inventory with data classification is foundational because you cannot assess risk to assets you have not identified. It reveals where customer data resides internally, which systems are in scope, and which owners are accountable. Without this, the assessment could omit critical repositories and produce an incomplete picture of confidentiality exposure, so it directly supports the board's expectation.
✗
Survey employees about their personal opinions on data privacy regulations.
Why it's wrong here
Employee opinions on regulations do not identify where customer data is stored or how it could be compromised. This activity produces sentiment, not risk data, and cannot substitute for asset inventory or threat mapping. It consumes assessment effort without improving scope coverage, so it does not help satisfy the board's expectation regarding internal and external risk factors.
✓
Map external threat sources and the attack surface exposed through third-party integrations.
Why this is correct
External factors such as threat actors and third-party connections can breach confidentiality even when internal controls are strong. Mapping threat sources to the exposed attack surface identifies where external parties could reach customer data and what controls are needed. This addresses the external dimension the board requested and complements the internal asset inventory, making it a necessary part of scope.

Go deeper

CRISC IT Risk Assessment Practice Question

Why each option matters

Option-by-option breakdown

Related to this question