Certified in Risk and Information Systems Control (CRISC) — Question 209

Which of the following MUST be assessed before considering risk treatment options for a scenario with significant impact?

Answer options

• A. Cost-benefit analysis.
• B. Incident probability.
• C. Risk magnitude.
• D. Risk appetite.

Correct answer: B

Explanation

Assessing incident probability is crucial as it helps determine how likely a risk event is to occur, which informs the risk treatment options. The cost-benefit analysis, risk magnitude, and risk appetite are important considerations but do not provide the foundational understanding of the likelihood of the risk, making them secondary to incident probability.