CRISC · Question #322
The PRIMARY benefit of conducting a risk workshop using a top-down approach instead of a bottom-up approach is the ability to:
The correct answer is B. obtain a holistic view of IT strategy risk. A top-down approach to a risk workshop provides a comprehensive perspective on strategic IT risks by aligning with the organization's overall objectives.
Question
The PRIMARY benefit of conducting a risk workshop using a top-down approach instead of a bottom-up approach is the ability to:
Options
- Aidentify specific project risk.
- Bobtain a holistic view of IT strategy risk.
- Cunderstand risk associated with complex processes.
- Dincorporate subject matter expertise.
How the community answered
(37 responses)- A3% (1)
- B89% (33)
- C3% (1)
- D5% (2)
Why each option
A top-down approach to a risk workshop provides a comprehensive perspective on strategic IT risks by aligning with the organization's overall objectives.
Identifying specific project risks is more characteristic of a bottom-up approach, which focuses on detailed operational or project-level risks.
A top-down approach typically starts with senior management and strategic objectives, providing a broad, holistic view of risks that impact the entire IT strategy rather than granular operational details. This ensures alignment with organizational goals and high-level strategic risk identification.
Understanding risks associated with complex processes is typically better achieved with a bottom-up approach, which delves into operational details and interdependencies.
Incorporating subject matter expertise is valuable in both top-down and bottom-up approaches, but it's not the primary distinguishing benefit of a top-down method.
Concept tested: Risk assessment methodologies (top-down vs. bottom-up)
Source: https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-39.pdf
Topics
Community Discussion
No community discussion yet for this question.