easyMultiple Choice
CRISC Practice Question: Which risk assessment method uses a matrix to…
Which risk assessment method uses a matrix to plot likelihood and impact to determine risk level?
⚠ Common exam trap
Test-takers frequently confuse the qualitative risk matrix with the Delphi technique, which is a consensus-building method, or mistakenly think Annual Loss Expectancy (ALE) is plotted on a matrix, when in fact ALE is a quantitative output.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Qualitative
The qualitative risk assessment method uses a matrix to plot likelihood and impact, typically with ordinal scales (e.g., high, medium, low) to derive a risk level. This approach is subjective and relies on expert judgment rather than numerical values, making it distinct from quantitative methods.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Delphi technique
Why it's wrong here
The Delphi technique is a qualitative consensus method that gathers anonymised expert opinion through iterative rounds; it produces judgements, not a likelihood-impact matrix. It tempts because it is a recognised risk assessment approach, and it would be correct when expert consensus is needed and objective data is scarce.
- ✗
Annual loss expectancy
Why it's wrong here
Annual loss expectancy is a quantitative calculation multiplying single loss expectancy by annualised rate of occurrence, yielding a monetary figure rather than plotting likelihood against impact. It tempts because it is a core risk metric, and it would be correct when the organisation needs to justify controls using expected yearly financial loss.
- ✓
Qualitative
Why this is correct
Qualitative assessment plots likelihood against impact on a matrix, assigning descriptive ratings such as high, medium or low to derive an overall risk level. This matrix-based plotting of the two dimensions is precisely what distinguishes it from quantitative methods.
- ✗
Quantitative
Why it's wrong here
Quantitative assessment assigns monetary values and calculates loss figures, producing numeric results rather than plotting likelihood against impact on a matrix. It tempts because it is a recognised risk assessment method, and it would be the right choice when the organisation needs financially expressed risk exposure for cost-benefit decisions.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 1,062 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.