CRISC Risk Response and Reporting Practice Question
During a third-party risk management review, the organization is tiering its vendors based on risk. Which TWO of the following criteria are most relevant for determining vendor risk tier?
⚠ Common exam trap
ISACA often tests the misconception that financial metrics like contract value or vendor size directly correlate with risk, but the CRISC exam emphasizes that risk is driven by data sensitivity and business impact, not cost or scale.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Criticality of service provided
The criticality of the service provided (A) directly determines the potential business impact if the vendor fails, making it a primary factor in risk tiering. Similarly, the level of data access (C) dictates the confidentiality and privacy risks, as vendors handling sensitive or regulated data (e.g., PII, PHI) pose higher inherent risk. Both criteria align with the ISACA risk management framework, which prioritizes impact and data sensitivity over financial or operational metrics.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Criticality of service provided
Why this is correct
Vendor risk tiering hinges on how severely a failure would disrupt the organization, so criticality of the service provided directly drives impact scoring. A vendor supporting a core revenue or safety function warrants a higher tier and deeper due diligence than one supplying peripheral services.
- ✗
Number of vendor employees
Why it's wrong here
Headcount does not indicate the sensitivity of data a vendor handles, its access to internal systems, or its operational criticality, which drive tiering. It is tempting because large vendors can pose concentration and resilience concerns, making size a valid factor in supply-chain or fourth-party assessments, but not a primary risk-tier criterion.
- ✓
Level of data access the vendor has
Why this is correct
Vendors holding access to sensitive or regulated data present greater potential impact if breached, so the depth and sensitivity of that access directly drives tiering. This satisfies the stem's requirement for a relevant criterion when determining vendor risk tier.
- ✗
Annual contract value
Why it's wrong here
Spend reflects budget exposure, not the business impact of a vendor failure, regulatory scope, or data classification, which determine tier. Contract value is genuinely useful for procurement prioritisation and financial forecasting, so it can appear in vendor management reporting, but it does not measure inherent risk.
- ✗
Vendor geographic location
Why it's wrong here
Geographic location alone does not determine inherent risk; what matters is data sensitivity, access to systems, regulatory exposure and criticality. Location is relevant only where it triggers specific jurisdictional or data-residency obligations, which then feed the tiering assessment.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 1,062-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.