CRISC IT Risk Identification Practice Question
A retail company is establishing an IT risk universe. Which of the following should be included as a primary category of IT risk?
⚠ Common exam trap
CRISC often tests whether candidates can distinguish IT risk categories from financial/market risk categories, so the trap is selecting a familiar-sounding financial risk (market, inflation, interest rate) instead of the IT-relevant third-party risk.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Third-party risk
Third-party risk is a primary IT risk category because organizations increasingly depend on vendors, cloud providers, and service integrators whose failures, breaches, or non-compliance directly affect the organization's IT risk posture. It belongs in the IT risk universe alongside categories such as cybersecurity, availability, data integrity, and compliance risk. Market, inflation, and interest rate risks are financial/market risks, not IT risk categories.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Market risk
Why it's wrong here
Market risk covers losses from movements in market prices such as interest rates, equities and currencies, which is a financial rather than IT risk category. Including it is tempting because risk universes often aggregate enterprise-wide risks, and market risk would belong in a treasury or financial risk register, not the IT risk universe.
- ✓
Third-party risk
Why this is correct
Third-party risk is a primary IT risk category because vendors and partners introduce exposure through shared data, integrated systems and outsourced processes. Including it in the risk universe ensures supplier dependencies are assessed alongside internal threats.
- ✗
Inflation risk
Why it's wrong here
Inflation risk is an economic/market risk affecting costs and pricing, not a primary IT risk category such as availability, integrity or infrastructure. It is tempting because inflation indirectly pressures IT budgets, but risk universes classify it under financial or business risk, not IT risk.
- ✗
Interest rate risk
Why it's wrong here
Interest rate risk is a financial/market risk affecting borrowing costs, not a primary IT risk category like security, availability or change. It is tempting because treasury systems hold rate exposure, but that belongs in the financial risk universe, not IT risk.
About these practice questions
One of 1,062 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.