nerdexam
Isaca

CRISC · Question #332

Which of the following provides the MOST useful information to trace the impact of aggregated risk across an organization's technical environment?

The correct answer is C. Enterprise architecture (EA) documentation. Enterprise architecture documentation provides the most useful information for tracing the impact of aggregated risk across an organization's technical environment.

Submitted by sofia.br· Apr 18, 2026IT Risk Assessment

Question

Which of the following provides the MOST useful information to trace the impact of aggregated risk across an organization's technical environment?

Options

  • ABusiness case documentation
  • BOrganizational risk appetite statement
  • CEnterprise architecture (EA) documentation
  • DOrganizational hierarchy

How the community answered

(37 responses)
  • A
    8% (3)
  • B
    14% (5)
  • C
    73% (27)
  • D
    5% (2)

Why each option

Enterprise architecture documentation provides the most useful information for tracing the impact of aggregated risk across an organization's technical environment.

ABusiness case documentation

Business case documentation primarily justifies projects or investments and typically lacks the granular technical interdependency details needed for tracing risk impacts.

BOrganizational risk appetite statement

An organizational risk appetite statement defines the acceptable level of risk but does not provide the technical structure or dependencies required to trace aggregated risk.

CEnterprise architecture (EA) documentationCorrect

Enterprise architecture (EA) documentation offers a comprehensive mapping of an organization's IT assets, including applications, systems, data flows, and infrastructure, along with their interdependencies. This detailed view is essential for understanding how a risk event in one component can propagate and aggregate its impact across interconnected technical systems.

DOrganizational hierarchy

Organizational hierarchy illustrates reporting structures and responsibilities, not the technical environment or system interdependencies crucial for tracing risk impact propagation.

Concept tested: Risk aggregation tracing

Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-160v1.pdf

Topics

#Enterprise Architecture#Risk Aggregation#Risk Impact Analysis#Technical Environment Mapping

Community Discussion

No community discussion yet for this question.

Full CRISC Practice