CRISC Risk Response and Reporting Practice Question
Which of the following best describes the purpose of a risk heat map in an IT risk report?
⚠ Common exam trap
CRISC often tests the distinction between a heat map (visual likelihood/impact representation) and a risk register or prioritized list — candidates confuse the visualization tool with the ranking or control-mapping artifacts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To provide a visual representation of the likelihood and impact of risks
A risk heat map is a visual tool that plots risks on a grid using likelihood (probability) on one axis and impact (consequence) on the other, typically with color coding (green/yellow/red) to indicate severity. Its primary purpose is to give decision-makers an at-a-glance view of which risks fall into high, medium, or low severity zones. This visual representation supports prioritization and communication, but the visualization itself — not the ranking — is the defining purpose.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
To list the top risks in order of priority
Why it's wrong here
A heat map positions risks on likelihood and impact axes; it does not produce a ranked list, which is a risk register or prioritised risk listing. It is tempting because both communicate priority, but ordering by number differs from plotting on two dimensions.
- ✗
To illustrate the relationship between risks and controls
Why it's wrong here
A heat map plots likelihood against impact to rank risks visually; it does not map risks to the controls mitigating them, which is a control matrix or risk-control mapping. It is tempting because both artefacts appear in risk reports, but the heat map's axes are probability and consequence.
- ✓
To provide a visual representation of the likelihood and impact of risks
Why this is correct
A risk heat map plots risks on a matrix whose axes are likelihood and impact, giving stakeholders a visual picture of relative exposure. This graphical representation satisfies the stem's requirement to describe the heat map's purpose in an IT risk report.
- ✗
To show the cost of controls
Why it's wrong here
A heat map displays likelihood and impact; control cost is a financial figure shown in cost-benefit analyses or budgets. It is tempting because risk reporting often includes control spend, but the heat map's axes are probability and consequence, not monetary value.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 1,062 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.