Certified in Risk and Information Systems Control (CRISC) — Question 876

Which of the following provides the MOST useful input when developing IT risk scenarios?

Answer options

• A. Recent external IT audit findings
• B. Internal security events and incidents
• C. History of IT risk policy noncompliance
• D. Internal and external risk factors

Correct answer: D

Explanation

Option D is correct because it encompasses a comprehensive view of both internal and external influences that can affect IT risks, providing a broader context for scenario development. The other options, while useful, focus on more specific aspects and do not capture the full range of factors that could impact risk scenarios.