Certified in Risk and Information Systems Control (CRISC) — Question 202

You are completing the qualitative risk analysis process with your project team and are relying on the risk management plan to help you determine the budget, schedule for risk management, and risk categories. You discover that the risk categories have not been created. When the risk categories should have been created?

Answer options

• A. Define scope process
• B. Risk identification process
• C. Plan risk management process
• D. Create work breakdown structure process

Correct answer: C

Explanation

The correct answer is C, as the risk categories should be established during the Plan risk management process, which sets the framework for how risks will be managed throughout the project. Options A and D relate to defining project scope and organizing tasks, while option B focuses on identifying risks rather than categorizing them.