Certified in Risk and Information Systems Control (CRISC) — Question 1370

Which of the following is BEST to use as a basis for developing a comprehensive list of IT risk scenarios?

Answer options

• A. IT architecture roadmap
• B. IT strategic plan
• C. IT asset inventory
• D. IT key risk indicators (KRIs)

Correct answer: C

Explanation

The correct answer, C (IT asset inventory), provides a comprehensive view of all IT assets, which is crucial for identifying potential risk scenarios. Options A (IT architecture roadmap) and B (IT strategic plan) focus more on future planning rather than current risks, while D (IT key risk indicators) are useful for monitoring but do not provide a complete list of scenarios.