CRISC IT Risk Assessment Practice Question
A multinational corporation is conducting a risk assessment for its supply chain. The risk team has identified a critical supplier that provides a unique component. The supplier is located in a region prone to natural disasters. The team wants to evaluate the risk and determine the appropriate risk response. Which of the following should be the FIRST step in this evaluation?
⚠ Common exam trap
The trap here is jumping to a risk response, such as finding alternative suppliers or buying insurance, before assessing the likelihood and impact of the risk.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Determine the likelihood and impact of a disruption from the supplier.
The first step in evaluating a risk is to assess its likelihood and impact. This provides the necessary information to prioritize the risk and decide on an appropriate response. Identifying alternatives, purchasing insurance, or implementing dual sourcing are potential responses that should be considered only after the risk has been evaluated. Starting with a response could lead to misallocation of resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement a dual-sourcing strategy immediately.
Why it's wrong here
Implementing a dual-sourcing strategy is a mitigation action that requires planning and investment. It should be based on the results of a risk evaluation. Without first assessing the likelihood and impact, the organization might over- or under-invest in mitigation. The evaluation helps determine if the risk is high enough to warrant the cost of dual sourcing. Thus, it is not the first step.
- ✓
Determine the likelihood and impact of a disruption from the supplier.
Why this is correct
The first step in risk evaluation is to assess the likelihood and impact of the risk event. For the critical supplier, this means estimating how probable a disruption is (based on the region's disaster history) and what the consequences would be (e.g., production halts, financial losses). This analysis provides the basis for prioritizing the risk and selecting an appropriate response. Without this, any response would be arbitrary.
- ✗
Purchase insurance to cover potential losses from supply chain disruption.
Why it's wrong here
Purchasing insurance is a risk transfer response that should come after evaluating the risk. It is not the first step because the organization needs to know the magnitude of the risk to determine if insurance is cost-effective and what coverage is appropriate. Insurance also does not address the operational impact of a disruption. The first step is always to assess the risk.
- ✗
Identify alternative suppliers that can provide the component.
Why it's wrong here
Identifying alternative suppliers is a risk response (mitigation) that should be considered after the risk has been evaluated. The first step is to understand the risk itself—its likelihood and impact—before deciding on a response. Jumping to solutions without assessing the risk could lead to unnecessary costs or inadequate response. The evaluation informs whether alternative suppliers are needed and how urgent the need is.
Go deeper
Related to this question
About these practice questions
One of 1,062 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.