hardMultiple Choice
CRISC Practice Question: A software development team is adopting Agile…
A software development team is adopting Agile methodology and wants to integrate risk identification into their sprints. Which approach BEST aligns with Agile principles while ensuring effective risk identification?
⚠ Common exam trap
Many exam-takers think risk identification is a one-time planning activity (Option A) or a single role's responsibility (Option B), but CRISC emphasizes that risk identification must be continuous and collaborative in Agile environments to be effective.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Incorporate a risk identification task in each sprint backlog and review risks during sprint retrospectives
Agile emphasizes iterative, continuous improvement, and integrating risk identification into each sprint backlog ensures risks are identified and addressed as the project evolves. Reviewing risks during sprint retrospectives aligns with the Agile principle of inspecting and adapting, making risk management a recurring, team-driven activity rather than a one-time event. This approach is effective because it captures risks that emerge from changing requirements, technical debt, or integration issues during development.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Conduct a risk workshop at the start of the project only
Why it's wrong here
A one-off upfront workshop cannot feed each sprint's inspect-and-adapt cycle, so newly emerging risks go unidentified in later iterations. It is tempting because a facilitated workshop does generate broad risk input, and would suit a predictive waterfall project with a fixed, defined scope.
- ✗
Assign risk identification solely to the product owner
Why it's wrong here
Concentrating risk identification in one role removes the cross-functional insight Agile depends on, so developers and testers cannot surface impediments during their own sprint work. It appeals because a product owner does own backlog prioritisation, making them the natural risk owner in a single-team, low-compliance setting.
- ✗
Perform an annual risk assessment
Why it's wrong here
An annual risk assessment runs outside the sprint cycle, so newly identified risks are not surfaced or addressed during iterations, contradicting Agile's incremental delivery. It is tempting because periodic assessments are a recognised governance practise, but Agile risk identification belongs in sprint reviews, retrospectives and backlog refinement.
- ✓
Incorporate a risk identification task in each sprint backlog and review risks during sprint retrospectives
Why this is correct
Adding a risk identification task to each sprint backlog and reviewing risks in retrospectives embeds risk work into existing Agile ceremonies, keeping it iterative and continuous. This satisfies the stem's requirement to align with Agile principles while ensuring risks are identified every sprint.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 1,062-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.