Match each CRISC domain to its description.
Drag a concept onto its matching description — or click a concept then click the description.
Establish and maintain a risk management framework
Identify and analyze IT risks
Select and implement risk mitigation controls
Continuously monitor and report risk status
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Governance: Focuses on establishing and maintaining a framework for IT governance, including organizational structure, policies, and processes.
The four CRISC domains are Governance, IT Risk Assessment, Risk Response and Reporting, and Information Technology and Security. Each domain has a distinct focus: Governance sets the framework, IT Risk Assessment identifies and evaluates risks, Risk Response and Reporting handles responses and communication, and Information Technology and Security protects assets through controls and architecture. Common confusions include swapping Governance with IT Risk Assessment, as both involve risk management but at different levels.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Governance: Focuses on establishing and maintaining a framework for IT governance, including organizational structure, policies, and processes.
Why this is correct
This correctly describes the Governance domain, which sets the IT governance framework.
IT Risk Assessment: Involves identifying, analyzing, and evaluating IT risks to determine their impact and likelihood.
Why this is correct
This correctly describes the IT Risk Assessment domain, which focuses on risk identification and evaluation.
Risk Response and Reporting: Addresses the selection and implementation of risk response options and ongoing reporting to stakeholders.
Why this is correct
This correctly describes the Risk Response and Reporting domain, covering response actions and communication.
Information Technology and Security: Covers the information security controls and technology architecture necessary to protect information assets.
Why this is correct
This correctly describes the Information Technology and Security domain, focusing on security controls and architecture.
Governance: Involves identifying, analyzing, and evaluating IT risks to determine their impact and likelihood.
Why it's wrong here
Incorrect — this definition describes IT Risk Assessment, not Governance.
IT Risk Assessment: Focuses on establishing and maintaining a framework for IT governance, including organizational structure, policies, and processes.
Why it's wrong here
Incorrect — this definition describes Governance, not IT Risk Assessment.
Go deeper
About these practice questions
Courseiva writes every CRISC question from scratch — 983 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.