Certified in Risk and Information Systems Control (CRISC) — Question 601

An organization is considering acquiring a new line of business and wants to develop new IT risk scenarios to guide its decisions. Which of the following would add the MOST value to the new risk scenarios?

Answer options

• A. Audit findings
• B. Expected losses
• C. Cost-benefit analysis
• D. Organizational threats

Correct answer: D

Explanation

Identifying organizational threats is crucial as it directly informs the risk landscape that the new business line may face. While audit findings, expected losses, and cost-benefit analysis are valuable, they do not specifically address the unique threats that could impact the new line of business as effectively as understanding organizational threats.