CRISC IT Risk Identification Practice Question
A risk practitioner is using the Delphi technique to estimate the likelihood of a sophisticated ransomware attack against a hospital network. The first round of expert opinions produced widely divergent estimates. Which of the following is the MOST appropriate next step in the Delphi process?
⚠ Common exam trap
The trap here is thinking that averaging or face-to-face debate is part of Delphi, when in fact anonymity and iterative feedback are essential.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Provide a statistical summary of the first-round estimates to the experts and ask them to revise their estimates in a second anonymous round.
The Delphi technique is an iterative, anonymous expert elicitation method. After the first round, the facilitator provides a statistical summary of the responses, such as the median and range, to the experts. The experts then revise their estimates in a second anonymous round. This process repeats until consensus or stability is achieved. Providing feedback and allowing revision is the defining characteristic of Delphi, making the second anonymous round the correct next step.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Replace the expert panel with a quantitative Monte Carlo simulation to model the ransomware likelihood.
Why it's wrong here
Switching to Monte Carlo simulation abandons the Delphi technique entirely. While Monte Carlo can be useful for quantitative risk analysis, it requires probability distributions and is not a substitute for expert judgment when historical data is scarce. The scenario specifically asks for the next step in the Delphi process, not an alternative method. Replacing the panel would ignore the divergent estimates and lose the benefits of structured expert elicitation.
- ✓
Provide a statistical summary of the first-round estimates to the experts and ask them to revise their estimates in a second anonymous round.
Why this is correct
The Delphi method involves iterative rounds where experts receive anonymized feedback, such as the median and interquartile range, and then revise their estimates. This controlled feedback helps converge toward consensus without direct confrontation. In this scenario, the divergent first-round estimates should be summarized and returned to the experts for a second round. This is the standard next step in the Delphi process.
- ✗
Discard the highest and lowest estimates and average the remaining responses to produce a single likelihood value.
Why it's wrong here
Discarding extremes and averaging is a technique sometimes used in simple forecasting, but it bypasses the Delphi method's iterative feedback. The Delphi technique relies on anonymous rounds of expert input with controlled feedback to converge on a consensus. Simply trimming outliers does not allow experts to refine their reasoning or consider others' perspectives. This approach would short-circuit the process and likely reduce the quality of the estimate.
- ✗
Convene a face-to-face meeting where experts debate their estimates until a unanimous consensus is reached.
Why it's wrong here
A face-to-face debate contradicts the Delphi method's core principle of anonymity, which is designed to prevent dominant personalities from influencing others. The Delphi technique uses anonymous questionnaires and controlled feedback across multiple rounds. Forcing a unanimous consensus in a meeting can introduce bias and pressure. This option describes a different technique, such as a focus group or nominal group technique, not Delphi.
About these practice questions
Courseiva writes every CRISC question from scratch — 1,062 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.