nerdexam
Isaca

CRISC · Question #322

The PRIMARY benefit of conducting a risk workshop using a top-down approach instead of a bottom-up approach is the ability to:

The correct answer is B. obtain a holistic view of IT strategy risk. A top-down approach to a risk workshop provides a comprehensive perspective on strategic IT risks by aligning with the organization's overall objectives.

Submitted by ricky.ec· Apr 18, 2026IT Risk Assessment

Question

The PRIMARY benefit of conducting a risk workshop using a top-down approach instead of a bottom-up approach is the ability to:

Options

  • Aidentify specific project risk.
  • Bobtain a holistic view of IT strategy risk.
  • Cunderstand risk associated with complex processes.
  • Dincorporate subject matter expertise.

How the community answered

(37 responses)
  • A
    3% (1)
  • B
    89% (33)
  • C
    3% (1)
  • D
    5% (2)

Why each option

A top-down approach to a risk workshop provides a comprehensive perspective on strategic IT risks by aligning with the organization's overall objectives.

Aidentify specific project risk.

Identifying specific project risks is more characteristic of a bottom-up approach, which focuses on detailed operational or project-level risks.

Bobtain a holistic view of IT strategy risk.Correct

A top-down approach typically starts with senior management and strategic objectives, providing a broad, holistic view of risks that impact the entire IT strategy rather than granular operational details. This ensures alignment with organizational goals and high-level strategic risk identification.

Cunderstand risk associated with complex processes.

Understanding risks associated with complex processes is typically better achieved with a bottom-up approach, which delves into operational details and interdependencies.

Dincorporate subject matter expertise.

Incorporating subject matter expertise is valuable in both top-down and bottom-up approaches, but it's not the primary distinguishing benefit of a top-down method.

Concept tested: Risk assessment methodologies (top-down vs. bottom-up)

Source: https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-39.pdf

Topics

#Risk workshop#Top-down approach#Strategic risk#Holistic risk view

Community Discussion

No community discussion yet for this question.

Full CRISC Practice