Risk Identification Techniques: Brainstorming & Threat Modeling

Quick Answer

The answer is threat modeling and brainstorming, as these are two of the recognized IT risk identification techniques explicitly cited in the CRISC exam domain. Threat modeling is correct because it systematically identifies threats, vulnerabilities, and potential attack vectors by analyzing system architecture, data flows, and trust boundaries, enabling proactive risk mitigation. Brainstorming leverages collective stakeholder expertise to surface a broad range of risk scenarios without requiring quantitative data, making it a foundational qualitative approach. On the Certified in Risk and Information Systems Control exam, this question tests your ability to distinguish recognized techniques from informal or non-standard methods; a common trap is confusing risk identification with risk analysis tools like SWOT or Delphi. Remember the memory tip: “Think of the two Bs—Brainstorming and Building threat models—as the core pair for surfacing risks before you analyze them.”