hardMultiple Select
CRISC Practice Question: Which THREE of the following are essential…
Which THREE of the following are essential components of a risk register that should be documented during risk identification? (Select exactly 3.)
⚠ Common exam trap
Many candidates confuse the risk identification phase with the risk assessment phase, selecting 'Quantified monetary impact' because they think it is needed upfront, when in fact it is only determined after the risk has been identified and analyzed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Risk owner
The risk register must capture B (Risk owner), because every identified risk needs an accountable individual responsible for monitoring and managing it throughout its lifecycle. C (Root cause) is essential because documenting the underlying source or driver of the risk enables proper analysis and effective treatment rather than just addressing symptoms. E (Risk description) is required to clearly articulate the nature of the risk, including the event, its potential consequences, and context, so it can be understood and prioritized. A (Quantified monetary impact) is not always essential at the identification stage, since qualitative or semi-quantitative assessments may suffice initially and quantification often occurs later during analysis. D (Mitigation plan) is a risk treatment output that follows assessment and is not a core identification component, as the register first needs to record the risk itself before responses are defined.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Quantified monetary impact
Why it's wrong here
Monetary impact is quantified during risk analysis, not identification, where the register records the risk description, owner, and category. Quantification is tempting because financial exposure drives prioritisation and treatment decisions, so it belongs in the register once analysis assigns values.
- ✓
Risk owner
Why this is correct
Assigning a named risk owner satisfies the accountability requirement of risk identification, ensuring each entry has a person responsible for monitoring and treatment. The register must record this alongside the risk description and assessment, so ownership is traceable rather than left with the risk team collectively.
- ✓
Root cause
Why this is correct
Recording the underlying root cause satisfies the register's need to explain why a risk exists, enabling targeted treatment rather than symptom management. It links each entry to its originating condition or control gap, which supports later risk analysis and response planning during the identification stage.
- ✗
Mitigation plan
Why it's wrong here
A mitigation plan is a risk response recorded during risk treatment, not an identification component; the register at identification captures risk description, cause, and potential impact. It is tempting because registers eventually hold mitigation details, but those are added after risks are assessed and prioritised.
- ✓
Risk description
Why this is correct
A risk description is essential because it records the nature of the identified risk, its cause and its potential consequence, giving decision-makers the context needed to assess likelihood and impact later. Without it, the register entry cannot be evaluated, prioritised or assigned an owner, so it satisfies the documentation requirement during risk identification.
Go deeper
Related to this question
About these practice questions
One of 1,062 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.