nerdexam
Isaca

CRISC · Question #252

An organization has allowed several employees to retire early in order to avoid layoffs Many of these employees have been subject matter experts for critical assets Which type of risk is MOST likely…

The correct answer is B. Institutional knowledge loss. The early retirement of subject matter experts (SMEs) creates a significant risk of institutional knowledge loss, as critical information and expertise vital for operations depart with these employees. This can lead to decreased efficiency, errors, or an inability to manage…

Submitted by satoshi_tk· Apr 18, 2026IT Risk Assessment

Question

An organization has allowed several employees to retire early in order to avoid layoffs Many of these employees have been subject matter experts for critical assets Which type of risk is MOST likely to materialize?

Options

  • AConfidentiality breach
  • BInstitutional knowledge loss
  • CIntellectual property loss
  • DUnauthorized access

How the community answered

(17 responses)
  • B
    94% (16)
  • C
    6% (1)

Why each option

The early retirement of subject matter experts (SMEs) creates a significant risk of institutional knowledge loss, as critical information and expertise vital for operations depart with these employees. This can lead to decreased efficiency, errors, or an inability to manage critical assets effectively.

AConfidentiality breach

While confidentiality breaches are a risk, the scenario specifically points to the departure of SMEs and their knowledge, not a compromise of sensitive information by malicious actors.

BInstitutional knowledge lossCorrect

When subject matter experts (SMEs) retire, they take with them their unique understanding, experience, and historical context regarding critical assets and processes. This departure directly leads to a loss of institutional knowledge, making it difficult for remaining staff to perform their duties or troubleshoot issues effectively.

CIntellectual property loss

Intellectual property loss typically refers to the unauthorized disclosure or theft of patents, copyrights, or trade secrets, which is not directly implied by employees retiring, even if they possess IP knowledge.

DUnauthorized access

Unauthorized access relates to individuals gaining entry to systems or data without proper permissions, which is distinct from the problem of expertise leaving the organization.

Concept tested: Human resource risk, institutional knowledge loss

Topics

#Institutional knowledge#Employee turnover risk#Operational risk#Subject matter experts (SMEs)

Community Discussion

No community discussion yet for this question.

Full CRISC Practice