CRISC IT Risk Identification Practice Question
When developing IT risk scenarios, connecting them to business impact is critical. Which of the following BEST describes how a risk practitioner should link a technical scenario to business impact?
⚠ Common exam trap
CRISC often tests the difference between risk assessment (likelihood/impact scoring) and business impact analysis; candidates may pick likelihood scoring or technical description when the question specifically asks how to link to business impact, which requires quantification in business terms.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Quantify the impact in terms of financial loss, regulatory penalty, and operational disruption
Quantifying impact in terms of financial loss, regulatory penalty, and operational disruption best links a technical risk scenario to business impact because it translates technical events into measurable business consequences. This allows risk to be expressed in terms that executives and business owners can understand and prioritize. It also supports cost-benefit analysis of risk treatment options.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign a likelihood rating and an inherent risk score
Why it's wrong here
Likelihood and inherent risk scores quantify the scenario but leave the business consequence undefined, so no linkage is established. Scoring is the step that follows impact identification, when the scenario has already been mapped to business processes and the practitioner needs to rank it.
- ✓
Quantify the impact in terms of financial loss, regulatory penalty, and operational disruption
Why this is correct
Expressing impact as financial loss, regulatory penalty and operational disruption links the technical scenario to business consequences using the standard impact categories, satisfying the stem's requirement to connect technical risk to business impact. This translation lets leadership compare and prioritise risks using consistent, decision-ready terms.
- ✗
Describe the technical steps of the attack in detail
Why it's wrong here
Detailing attack steps describes the threat event itself, not its consequence, so it never reaches the business impact the scenario must express. This technical narrative is what a threat-modelling or vulnerability assessment exercise requires, where the mechanics of exploitation are the deliverable.
- ✗
Reference industry benchmarks for similar scenarios
Why it's wrong here
Industry benchmarks supply comparative likelihood or loss data for calibrating a scenario, but they do not connect this organisation's specific technical event to its own business consequences. Benchmarks belong in risk quantification or maturity comparison, where external peer data substitutes for scarce internal loss history.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 1,062 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.