CRISC IT Risk Identification Practice Question
A risk practitioner is selecting a risk analysis technique for a new payment processing system. The team has limited historical loss data, wants to incorporate expert judgment, and needs to prioritize risks for management review. Which technique is MOST appropriate?
⚠ Common exam trap
The trap here is defaulting to a quantitative method like Monte Carlo when the scenario explicitly states that historical loss data is limited.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Delphi technique to gather and converge expert opinions on likelihood and impact.
When historical loss data is scarce and expert judgment must be captured, the Delphi technique provides a structured, anonymous, iterative approach that converges on consensus estimates of likelihood and impact. It reduces individual bias and yields a defensible prioritization suitable for management review. Quantitative methods like Monte Carlo require reliable data, while fault tree and business impact analysis serve different analytical purposes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Business impact analysis to determine recovery time and recovery point objectives for the payment system.
Why it's wrong here
Business impact analysis focuses on identifying critical business functions and establishing recovery objectives, not on ranking a portfolio of risks. While valuable for continuity planning, it does not provide the comparative likelihood-and-impact prioritization the practitioner needs. Using BIA output as a risk prioritization method would conflate continuity requirements with overall risk ranking.
- ✗
Fault tree analysis to trace the logical combinations of failures that could cause a payment outage.
Why it's wrong here
Fault tree analysis is a deductive reliability technique that models combinations of component failures leading to a specific undesired event. It is excellent for root-cause and availability analysis but does not by itself prioritize a broad set of risks for management review. The scenario calls for incorporating expert judgment across many risks, not decomposing one failure event.
- ✗
Monte Carlo simulation using historical loss distributions from the past five years.
Why it's wrong here
Monte Carlo simulation is powerful but depends on reliable probability distributions, which the team lacks due to limited historical loss data. Forcing simulation with weak inputs produces false precision and can mislead prioritization. The scenario's constraints point toward a qualitative or semi-quantitative method that leverages expert judgment rather than quantitative modeling requiring robust data.
- ✓
Delphi technique to gather and converge expert opinions on likelihood and impact.
Why this is correct
The Delphi technique collects anonymous expert judgments over iterative rounds until consensus emerges, which fits the lack of historical data and the need to use expert opinion. It reduces bias from dominant personalities and produces a defensible ranking of risks for management review. This makes it well suited to prioritizing risks for a new payment system where loss history is thin.
Go deeper
Related to this question
About these practice questions
One of 1,062 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.