CRISC Risk Response and Reporting Practice Question

What is the primary purpose of a risk heat map in IT risk reporting?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Provide a visual representation of risk levels

A risk heat map visualizes risks based on likelihood and impact, helping prioritize attention.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Show control performance metrics
Why it's wrong here
A heat map plots inherent or residual risk by likelihood and impact; control performance is measured through control testing metrics and KRIs, a separate reporting stream. It tempts because controls influence residual risk placement, but the map shows the resulting exposure, not whether each control operates effectively.
✗
Display risk trends over time
Why it's wrong here
A heat map plots likelihood against impact to prioritise risks visually; it holds no time axis, so trend tracking is impossible. Trend reporting belongs to line charts or historical risk registers. It tempts because heat maps are often refreshed periodically, implying movement, but each snapshot is static.
✓
Provide a visual representation of risk levels
Why this is correct
A risk heat map plots likelihood against impact, using colour coding to show which risks sit in high, medium or low bands. This satisfies the reporting need by letting management and the board quickly compare risk levels across the portfolio and prioritise treatment.
✗
List upcoming risk events
Why it's wrong here
A heat map plots likelihood against impact for current risks; it carries no scheduling or calendar dimension, so upcoming events cannot be listed. Forward-looking event tracking belongs to a risk register or calendar view. It tempts because heat maps are reviewed regularly, but they depict present exposure, not future occurrences.

Go deeper