CRISC Information Technology and Security Practice Question
A risk manager is designing an IT risk management programme. Which THREE of the following are essential components of a risk management policy?
⚠ Common exam trap
Many candidates confuse operational artifacts (risk treatment plans and risk registers) with policy-level components, failing to recognize that the policy sets the framework and mandates, not the specific details of each risk response.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Risk assessment methodology
A risk assessment methodology is an essential component of a risk management policy because it defines the standardized approach for identifying, analyzing, and evaluating IT risks. Without a prescribed methodology, risk assessments would be inconsistent, making it impossible to compare risks across the organization or to align them with the risk appetite. The policy must mandate a repeatable process, such as NIST SP 800-30 or ISO 31010, to ensure objectivity and defensibility in risk decisions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Risk assessment methodology
Why this is correct
Methodology defines how risks are assessed.
- ✗
Specific risk treatment plans
Why it's wrong here
Treatment plans are operational, not policy-level.
- ✓
Risk appetite statement
Why this is correct
Risk appetite defines acceptable risk levels.
- ✗
Detailed risk register
Why it's wrong here
Risk register is a tool, not part of the policy itself.
- ✓
Roles and responsibilities for risk management
Why this is correct
Clear roles are essential for accountability.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 983-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.