mediumMultiple ChoiceObjective-mapped
CRISC Practice Question: During a merger and acquisition (M&A) due…
During a merger and acquisition (M&A) due diligence, the acquiring company's IT risk manager is tasked with identifying risks in the target's IT environment. Which of the following would be the MOST effective technique to uncover hidden risks?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Perform an on-site technical assessment and interview key IT staff
An on-site technical assessment and interviews with key IT staff allow the risk manager to observe actual controls, uncover undocumented systems, assess security culture, and identify risks that may not be reflected in documentation. Option A is incorrect because the target's existing risk register may be incomplete, outdated, or biased, and may not capture all hidden risks. Option C is incorrect because reviewing IT policies and procedures only provides a high-level view of intended controls, not their actual implementation or effectiveness. Option D is incorrect because a network vulnerability scan focuses solely on technical vulnerabilities and does not address process, governance, or cultural risks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Analyze the target's existing risk register
Why it's wrong here
The register may be incomplete or biased.
- ✓
Perform an on-site technical assessment and interview key IT staff
Why this is correct
Direct assessment uncovers undocumented controls and cultural issues.
- ✗
Review the target's IT policies and procedures
Why it's wrong here
Policies may not reflect actual practices.
- ✗
Conduct a network vulnerability scan
Why it's wrong here
Scanning only addresses technical vulnerabilities, not process risks.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 983 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.