CRISC IT Risk Identification Practice Question
Which of the following best describes the purpose of an IT risk universe?
⚠ Common exam trap
CRISC often tests the distinction between the risk universe and its inputs; candidates may pick 'catalog of assets and vulnerabilities' because it sounds comprehensive, missing that the universe is about risks, not assets.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A comprehensive inventory of all potential IT risks facing the organization
An IT risk universe is the comprehensive inventory of all potential IT risks that could affect the organization — it is the master list from which specific risk assessments and scenarios are drawn. It provides the scope for risk management activities and ensures no material risk category is overlooked. It is not limited to assets, incidents, or scenarios.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A catalog of all IT assets and their vulnerabilities
Why it's wrong here
A risk universe is not an asset inventory; it defines the scope of risks an organisation chooses to assess and manage, ranked by business impact. Cataloguing IT assets and their vulnerabilities describes an asset register feeding vulnerability management, which would be the right artefact when the goal is identifying technical weaknesses rather than framing risk coverage.
- ✗
A list of all past security incidents
Why it's wrong here
A list of past security incidents is an incident register, not a risk universe. It records events that have already occurred, whereas the risk universe catalogues all identifiable risk sources and categories requiring assessment. It tempts because incident data often feeds risk identification, and an incident log would be the correct artefact when the objective is post-incident trend analysis or root-cause reporting.
- ✗
A set of risk scenarios used for quantitative analysis
Why it's wrong here
A risk universe is the complete inventory of risks an organisation faces, not a subset of scenarios selected for quantitative analysis. Scenario sets serve focused modelling exercises, such as Monte Carlo simulation of specific loss events. This option confuses the scoping input to analysis with the enterprise-wide catalogue from which scenarios are drawn.
- ✓
A comprehensive inventory of all potential IT risks facing the organization
Why this is correct
The IT risk universe is the complete catalogue of plausible IT-related risks that could affect the organisation, providing the scope against which assessments, appetite statements and treatment decisions are framed. It is an inventory of potential risks, not a control register or a list of realised incidents.
Go deeper
Related to this question
About these practice questions
One of 1,062 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.