Certified in Risk and Information Systems Control (CRISC) — Question 1008

It is MOST important for a risk practitioner to have an awareness of an organization's processes in order to:

Answer options

• A. perform a business impact analysis (BIA)
• B. establish risk guidelines
• C. understand control design
• D. identify potential sources of risk

Correct answer: D

Explanation

The correct answer is D because identifying potential sources of risk directly relies on the knowledge of the organization's processes. The other options, while important, are secondary to the need for understanding risks that arise from these processes.