CRISC IT Risk Assessment Practice Question
An e-commerce company is conducting an IT risk assessment for its order management system. The risk team has identified a risk that the system could fail during peak holiday traffic, causing revenue loss. The team needs to estimate the potential financial impact of this event to inform treatment decisions. Which activity is the team performing?
⚠ Common exam trap
Candidates often confuse risk analysis with risk response, when estimating impact is analysis and choosing how to treat the risk comes afterward.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Risk analysis
After a risk is identified, risk analysis evaluates its likelihood and potential impact. The team has already named the peak-traffic failure risk and is now estimating its financial consequence, which is impact analysis within the broader risk analysis step. This estimation supports informed risk response decisions, such as investing in capacity or redundancy for the order management system.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Risk identification
Why it's wrong here
Risk identification is the process of discovering and documenting risks, which the team has already done by naming the peak-traffic failure risk. Estimating the financial impact of that already-identified risk is a separate step. Confusing the two would suggest the team is still finding risks rather than quantifying the consequences of a known one.
- ✓
Risk analysis
Why this is correct
Risk analysis involves evaluating the nature and magnitude of an identified risk, including estimating potential financial impact and likelihood. The team has already identified the peak-traffic failure risk and is now determining its financial consequence to guide treatment. This estimation step is a core part of risk analysis within the IT risk assessment process.
- ✗
Risk response
Why it's wrong here
Risk response is selecting and implementing treatment, such as mitigating, transferring, avoiding, or accepting the risk. The team is still estimating impact and has not yet chosen a treatment. Labeling this as risk response skips the analysis needed to justify a treatment decision and would leave the choice of controls unsupported by impact data.
- ✗
Risk monitoring
Why it's wrong here
Risk monitoring is the ongoing tracking of risks, controls, and treatment effectiveness over time. Estimating the financial impact of a newly identified peak-traffic failure risk is a forward-looking analytical activity, not ongoing monitoring. Treating it as monitoring would imply the risk is already being tracked rather than analyzed for the first time.
Go deeper
Related to this question
About these practice questions
One of 1,062 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.