CRISC IT Risk Assessment Practice Question
A multinational bank is assessing risk for a new mobile banking feature that stores limited customer data on devices. The risk team must decide whether to use a qualitative or quantitative approach. Which of the following is the MOST important factor in making this decision?
⚠ Common exam trap
The trap here is letting organizational preferences or timelines dictate methodology instead of the availability of reliable data and the need for financial expression.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The availability of reliable historical loss data and the need to express risk in financial terms.
Selecting a qualitative or quantitative risk assessment method depends primarily on whether reliable data exists to support quantification and whether decisions require financial expression. When loss data is credible and cost-benefit analysis is needed, quantitative methods add value. When data is sparse or decisions are strategic, qualitative methods are more practical and defensible.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The number of risks identified in the risk register and the size of the assessment team.
Why it's wrong here
The volume of risks and team size affect effort and scheduling, not the fundamental choice of methodology. A large register can be assessed qualitatively or quantitatively. Team size may influence feasibility, but it does not determine whether financial quantification is meaningful. The key driver is whether data and decision needs support quantification, not how many risks or people are involved.
- ✗
The preference of the business unit sponsor and the timeline for the product launch.
Why it's wrong here
Sponsor preference and timeline are practical constraints, but they should not override the methodological requirements of the assessment. A tight timeline might favor qualitative methods, yet if the decision requires financial justification, qualitative results may be inadequate. The primary factor is the nature of the data and the decision, not scheduling or personal preference.
- ✗
The regulatory requirement to perform an annual risk assessment and the audit committee's reporting schedule.
Why it's wrong here
Regulatory and reporting deadlines dictate when assessments occur, not which method is used. Both qualitative and quantitative approaches can satisfy annual assessment requirements. The reporting schedule may influence format, but it does not determine whether quantification is feasible or necessary. The decision should be based on data reliability and decision needs.
- ✓
The availability of reliable historical loss data and the need to express risk in financial terms.
Why this is correct
The choice between qualitative and quantitative risk assessment hinges on data availability and the decision-making need. If reliable loss data exists and stakeholders require financial expression for cost-benefit analysis, quantitative methods are appropriate. If data is scarce or decisions are strategic, qualitative methods suffice. This factor directly determines which approach will produce meaningful, defensible results.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 1,062 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.