CRISC Glossary | Practice Test / Quiz / MCQs

Home > Certified in Risk and Information Systems Control (CRISC) Certification > Quizzes > CRISC Glossary

CRISC Glossary

Fast practice, instant feedback. Timer auto-submits when time’s up.

Avg score: 30% • Most missed: “IT risk scenario”

Study First Challenge a Friend Stats

CRISC Glossary

Time left 00:00

25 Questions

1. Risk portfolio view

Any event where a threat event results in loss. Scope note: From Jones, J.; 'FAIR Taxonomy,' Risk Management Insight, USA, 2008.The business risk associated with the use, ownership, operation, involvement, influence and adoption of IT within an enterprise.1. A method to identify interdependencies and interconnections among risk, as well as the effect of risk responses on multiple types of risk 2. A method to estimate the aggregate impact of multiple types of risk (e.g., cascading and coincidental threat types/scenarios, risk concentration/correlation across silos) and the potential effect of risk response across multiple types of risk.A method/process by which management and staff of all levels collectively identify and evaluate risk and controls with their business areas. This may be under the guidance of a facilitator such as an auditor or risk manager..

2. Control risk self-assessment

Any event where a threat event results in loss. Scope note: From Jones, J.; 'FAIR Taxonomy,' Risk Management Insight, USA, 2008.The business risk associated with the use, ownership, operation, involvement, influence and adoption of IT within an enterprise.A method/process by which management and staff of all levels collectively identify and evaluate risk and controls with their business areas. This may be under the guidance of a facilitator such as an auditor or risk manager..1. A method to identify interdependencies and interconnections among risk, as well as the effect of risk responses on multiple types of risk 2. A method to estimate the aggregate impact of multiple types of risk (e.g., cascading and coincidental threat types/scenarios, risk concentration/correlation across silos) and the potential effect of risk response across multiple types of risk.

3. Loss event

A method/process by which management and staff of all levels collectively identify and evaluate risk and controls with their business areas. This may be under the guidance of a facilitator such as an auditor or risk manager..1. A method to identify interdependencies and interconnections among risk, as well as the effect of risk responses on multiple types of risk 2. A method to estimate the aggregate impact of multiple types of risk (e.g., cascading and coincidental threat types/scenarios, risk concentration/correlation across silos) and the potential effect of risk response across multiple types of risk.Any event where a threat event results in loss. Scope note: From Jones, J.; 'FAIR Taxonomy,' Risk Management Insight, USA, 2008.The business risk associated with the use, ownership, operation, involvement, influence and adoption of IT within an enterprise.

4. IT risk

1. A method to identify interdependencies and interconnections among risk, as well as the effect of risk responses on multiple types of risk 2. A method to estimate the aggregate impact of multiple types of risk (e.g., cascading and coincidental threat types/scenarios, risk concentration/correlation across silos) and the potential effect of risk response across multiple types of risk.Any event where a threat event results in loss. Scope note: From Jones, J.; 'FAIR Taxonomy,' Risk Management Insight, USA, 2008.The business risk associated with the use, ownership, operation, involvement, influence and adoption of IT within an enterprise.A method/process by which management and staff of all levels collectively identify and evaluate risk and controls with their business areas. This may be under the guidance of a facilitator such as an auditor or risk manager..

5. Business process owner

A method/process by which management and staff of all levels collectively identify and evaluate risk and controls with their business areas. This may be under the guidance of a facilitator such as an auditor or risk manager..1. A method to identify interdependencies and interconnections among risk, as well as the effect of risk responses on multiple types of risk 2. A method to estimate the aggregate impact of multiple types of risk (e.g., cascading and coincidental threat types/scenarios, risk concentration/correlation across silos) and the potential effect of risk response across multiple types of risk.Any event where a threat event results in loss. Scope note: From Jones, J.; 'FAIR Taxonomy,' Risk Management Insight, USA, 2008.The individual responsible for identifying process requirements, approving process design and managing process performance. Scope note: Must be at an appropriately high level in the enterprise and have authority to commit resources to process-specific risk management activities.

6. Business continuity plan (BCP)

7. Project portfolio

8. Governance enabler

1. A method to identify interdependencies and interconnections among risk, as well as the effect of risk responses on multiple types of risk 2. A method to estimate the aggregate impact of multiple types of risk (e.g., cascading and coincidental threat types/scenarios, risk concentration/correlation across silos) and the potential effect of risk response across multiple types of risk.Any event where a threat event results in loss. Scope note: From Jones, J.; 'FAIR Taxonomy,' Risk Management Insight, USA, 2008.Something (tangible or intangible) that assists in the realization of effective governance. Scope notes: COBIT 5 perspective.A method/process by which management and staff of all levels collectively identify and evaluate risk and controls with their business areas. This may be under the guidance of a facilitator such as an auditor or risk manager..

9. Encryption algorithm

A method/process by which management and staff of all levels collectively identify and evaluate risk and controls with their business areas. This may be under the guidance of a facilitator such as an auditor or risk manager..A mathematically based function or calculation that encrypts/decrypts data.Any event where a threat event results in loss. Scope note: From Jones, J.; 'FAIR Taxonomy,' Risk Management Insight, USA, 2008.1. A method to identify interdependencies and interconnections among risk, as well as the effect of risk responses on multiple types of risk 2. A method to estimate the aggregate impact of multiple types of risk (e.g., cascading and coincidental threat types/scenarios, risk concentration/correlation across silos) and the potential effect of risk response across multiple types of risk.

10. Control

The means of managing risk, including policies, procedures, guidelines, practices or organizational structures, which can be of an administrative, technical, management, or legal nature.1. A method to identify interdependencies and interconnections among risk, as well as the effect of risk responses on multiple types of risk 2. A method to estimate the aggregate impact of multiple types of risk (e.g., cascading and coincidental threat types/scenarios, risk concentration/correlation across silos) and the potential effect of risk response across multiple types of risk.Any event where a threat event results in loss. Scope note: From Jones, J.; 'FAIR Taxonomy,' Risk Management Insight, USA, 2008.A method/process by which management and staff of all levels collectively identify and evaluate risk and controls with their business areas. This may be under the guidance of a facilitator such as an auditor or risk manager..

11. Objectivity

1. A method to identify interdependencies and interconnections among risk, as well as the effect of risk responses on multiple types of risk 2. A method to estimate the aggregate impact of multiple types of risk (e.g., cascading and coincidental threat types/scenarios, risk concentration/correlation across silos) and the potential effect of risk response across multiple types of risk.A method/process by which management and staff of all levels collectively identify and evaluate risk and controls with their business areas. This may be under the guidance of a facilitator such as an auditor or risk manager..The ability to exercise judgment, express opinions and present recommendations with impartiality.Any event where a threat event results in loss. Scope note: From Jones, J.; 'FAIR Taxonomy,' Risk Management Insight, USA, 2008.

12. Risk appetite

The amount of risk, on a broad level, that an entity is willing to accept in pursuit of its mission.Any event where a threat event results in loss. Scope note: From Jones, J.; 'FAIR Taxonomy,' Risk Management Insight, USA, 2008.A method/process by which management and staff of all levels collectively identify and evaluate risk and controls with their business areas. This may be under the guidance of a facilitator such as an auditor or risk manager..1. A method to identify interdependencies and interconnections among risk, as well as the effect of risk responses on multiple types of risk 2. A method to estimate the aggregate impact of multiple types of risk (e.g., cascading and coincidental threat types/scenarios, risk concentration/correlation across silos) and the potential effect of risk response across multiple types of risk.

13. Capability Maturity Model (CMM)

Any event where a threat event results in loss. Scope note: From Jones, J.; 'FAIR Taxonomy,' Risk Management Insight, USA, 2008.A method/process by which management and staff of all levels collectively identify and evaluate risk and controls with their business areas. This may be under the guidance of a facilitator such as an auditor or risk manager..1. A method to identify interdependencies and interconnections among risk, as well as the effect of risk responses on multiple types of risk 2. A method to estimate the aggregate impact of multiple types of risk (e.g., cascading and coincidental threat types/scenarios, risk concentration/correlation across silos) and the potential effect of risk response across multiple types of risk. 1. Contains the essential elements of effective processes for one or more disciplines. It also describes an evolutionary improvement path from ad hoc, immature processes to disciplined, mature processes with improved quality and effectiveness 2. CMM for software, from the Software Engineering Institute (SEI), is a model used by many enterprises to identify best practices useful in helping them assess and increase the maturity of their software development processes. Scope notes: CMM ranks software development enterprises according to a hierarchy of five process maturity levels. Each level ranks the development environment according to its capability of producing quality software. A set of standards is associated with each of the five levels. The standards for level one describe the most immature or chaotic processes and the standards for level five describe the most mature or quality processes. A maturity model that indicates the degree of reliability or dependency the business can place on a process achieving the desired goals or objectives. A collection of instructions that an enterprise can follow to gain better control over its software development process.

14. Business goal

A method/process by which management and staff of all levels collectively identify and evaluate risk and controls with their business areas. This may be under the guidance of a facilitator such as an auditor or risk manager..Any event where a threat event results in loss. Scope note: From Jones, J.; 'FAIR Taxonomy,' Risk Management Insight, USA, 2008.1. A method to identify interdependencies and interconnections among risk, as well as the effect of risk responses on multiple types of risk 2. A method to estimate the aggregate impact of multiple types of risk (e.g., cascading and coincidental threat types/scenarios, risk concentration/correlation across silos) and the potential effect of risk response across multiple types of risk.The translation of the enterprise’s mission from a statement of intention into performance targets and results.

15. Portfolio

A grouping of 'objects of interest' (investment programs, IT services, IT projects, other IT assets or resources) managed and monitored to optimize business value. (The investment portfolio is of primary interest to Val IT. The IT service, project, asset and other resource portfolios are of primary interest to COBIT.).1. A method to identify interdependencies and interconnections among risk, as well as the effect of risk responses on multiple types of risk 2. A method to estimate the aggregate impact of multiple types of risk (e.g., cascading and coincidental threat types/scenarios, risk concentration/correlation across silos) and the potential effect of risk response across multiple types of risk.A method/process by which management and staff of all levels collectively identify and evaluate risk and controls with their business areas. This may be under the guidance of a facilitator such as an auditor or risk manager..Any event where a threat event results in loss. Scope note: From Jones, J.; 'FAIR Taxonomy,' Risk Management Insight, USA, 2008.

16. Qualitative risk analysis

A method/process by which management and staff of all levels collectively identify and evaluate risk and controls with their business areas. This may be under the guidance of a facilitator such as an auditor or risk manager..Defines risk using a scale or comparative values (i.e., defining risk factors in terms of high/medium/low or on a numeric scale from 1 to 10). It is based on judgment, intuition and experience rather than on financial values.1. A method to identify interdependencies and interconnections among risk, as well as the effect of risk responses on multiple types of risk 2. A method to estimate the aggregate impact of multiple types of risk (e.g., cascading and coincidental threat types/scenarios, risk concentration/correlation across silos) and the potential effect of risk response across multiple types of risk.Any event where a threat event results in loss. Scope note: From Jones, J.; 'FAIR Taxonomy,' Risk Management Insight, USA, 2008.

17. Business continuity

Any event where a threat event results in loss. Scope note: From Jones, J.; 'FAIR Taxonomy,' Risk Management Insight, USA, 2008.Preventing, mitigating and recovering from disruption. Scope notes: The terms 'business resumption planning,' 'disaster recovery planning' and 'contingency planning' also may be used in this context; they focus on recovery aspects of continuity, and for that reason the ‘resilience’ aspect should also be taken into account..A method/process by which management and staff of all levels collectively identify and evaluate risk and controls with their business areas. This may be under the guidance of a facilitator such as an auditor or risk manager..1. A method to identify interdependencies and interconnections among risk, as well as the effect of risk responses on multiple types of risk 2. A method to estimate the aggregate impact of multiple types of risk (e.g., cascading and coincidental threat types/scenarios, risk concentration/correlation across silos) and the potential effect of risk response across multiple types of risk.

18. Enterprise resource planning (ERP) system

A method/process by which management and staff of all levels collectively identify and evaluate risk and controls with their business areas. This may be under the guidance of a facilitator such as an auditor or risk manager..A packaged business software system that allows an enterprise to automate and integrate the majority of its business processes, share common data and practices across the entire enterprise, and produce and access information in a real-time environment. Scope notes: Examples of ERP include SAP, Oracle Financials and J.D. Edwards..Any event where a threat event results in loss. Scope note: From Jones, J.; 'FAIR Taxonomy,' Risk Management Insight, USA, 2008.1. A method to identify interdependencies and interconnections among risk, as well as the effect of risk responses on multiple types of risk 2. A method to estimate the aggregate impact of multiple types of risk (e.g., cascading and coincidental threat types/scenarios, risk concentration/correlation across silos) and the potential effect of risk response across multiple types of risk.

19. IT architecture

Description of the fundamental underlying design of the IT components of the business, the relationships among them, and the manner in which they support the enterprise’s objectives.A method/process by which management and staff of all levels collectively identify and evaluate risk and controls with their business areas. This may be under the guidance of a facilitator such as an auditor or risk manager..Any event where a threat event results in loss. Scope note: From Jones, J.; 'FAIR Taxonomy,' Risk Management Insight, USA, 2008.1. A method to identify interdependencies and interconnections among risk, as well as the effect of risk responses on multiple types of risk 2. A method to estimate the aggregate impact of multiple types of risk (e.g., cascading and coincidental threat types/scenarios, risk concentration/correlation across silos) and the potential effect of risk response across multiple types of risk.

20. RACI chart

Any event where a threat event results in loss. Scope note: From Jones, J.; 'FAIR Taxonomy,' Risk Management Insight, USA, 2008.1. A method to identify interdependencies and interconnections among risk, as well as the effect of risk responses on multiple types of risk 2. A method to estimate the aggregate impact of multiple types of risk (e.g., cascading and coincidental threat types/scenarios, risk concentration/correlation across silos) and the potential effect of risk response across multiple types of risk.Illustrates who is Responsible, Accountable, Consulted and Informed within an organizational framework.A method/process by which management and staff of all levels collectively identify and evaluate risk and controls with their business areas. This may be under the guidance of a facilitator such as an auditor or risk manager..

21. Root cause analysis

Any event where a threat event results in loss. Scope note: From Jones, J.; 'FAIR Taxonomy,' Risk Management Insight, USA, 2008.A process of diagnosis to establish the origins of events, which can be used for learning from consequences, typically from errors and problems.1. A method to identify interdependencies and interconnections among risk, as well as the effect of risk responses on multiple types of risk 2. A method to estimate the aggregate impact of multiple types of risk (e.g., cascading and coincidental threat types/scenarios, risk concentration/correlation across silos) and the potential effect of risk response across multiple types of risk.A method/process by which management and staff of all levels collectively identify and evaluate risk and controls with their business areas. This may be under the guidance of a facilitator such as an auditor or risk manager..

22. Threat agent

1. A method to identify interdependencies and interconnections among risk, as well as the effect of risk responses on multiple types of risk 2. A method to estimate the aggregate impact of multiple types of risk (e.g., cascading and coincidental threat types/scenarios, risk concentration/correlation across silos) and the potential effect of risk response across multiple types of risk.Any event where a threat event results in loss. Scope note: From Jones, J.; 'FAIR Taxonomy,' Risk Management Insight, USA, 2008.A method/process by which management and staff of all levels collectively identify and evaluate risk and controls with their business areas. This may be under the guidance of a facilitator such as an auditor or risk manager..Methods and things used to exploit a vulnerability. Scope notes: Examples include determination, capability, motive and resources.

23. Confidentiality

Preserving authorized restrictions on access and disclosure, including means for protecting privacy and proprietary information.1. A method to identify interdependencies and interconnections among risk, as well as the effect of risk responses on multiple types of risk 2. A method to estimate the aggregate impact of multiple types of risk (e.g., cascading and coincidental threat types/scenarios, risk concentration/correlation across silos) and the potential effect of risk response across multiple types of risk.Any event where a threat event results in loss. Scope note: From Jones, J.; 'FAIR Taxonomy,' Risk Management Insight, USA, 2008.A method/process by which management and staff of all levels collectively identify and evaluate risk and controls with their business areas. This may be under the guidance of a facilitator such as an auditor or risk manager..

24. Awareness

Being acquainted with, mindful of, conscious of and well informed on a specific subject, which implies knowing and understanding a subject and acting accordingly.Any event where a threat event results in loss. Scope note: From Jones, J.; 'FAIR Taxonomy,' Risk Management Insight, USA, 2008.1. A method to identify interdependencies and interconnections among risk, as well as the effect of risk responses on multiple types of risk 2. A method to estimate the aggregate impact of multiple types of risk (e.g., cascading and coincidental threat types/scenarios, risk concentration/correlation across silos) and the potential effect of risk response across multiple types of risk.A method/process by which management and staff of all levels collectively identify and evaluate risk and controls with their business areas. This may be under the guidance of a facilitator such as an auditor or risk manager..

25. Residual risk

Any event where a threat event results in loss. Scope note: From Jones, J.; 'FAIR Taxonomy,' Risk Management Insight, USA, 2008.1. A method to identify interdependencies and interconnections among risk, as well as the effect of risk responses on multiple types of risk 2. A method to estimate the aggregate impact of multiple types of risk (e.g., cascading and coincidental threat types/scenarios, risk concentration/correlation across silos) and the potential effect of risk response across multiple types of risk.The remaining risk after management has implemented risk response.A method/process by which management and staff of all levels collectively identify and evaluate risk and controls with their business areas. This may be under the guidance of a facilitator such as an auditor or risk manager..

⚡ Recently practiced quizzes in this topic

Live quiz activity

CRISC Assessment Test

25 Questions

❤ If you liked Fatskills, consider supporting us by checking out The Life Manuals You Never Got.

About | Explore | User Guide | Topics | Subjects | Doubt Solver | Career Aptitude Test | Answers | Free Tools | OSHA Basics Quiz | What Should We Know?
Privacy | Terms |

Without work one finishes nothing. - Ralph Waldo Emerson
© 2026 Fatskills.com

All trademarks, logos and brand names are the property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, trademarks and brands does not imply endorsement.

25 Questions

❤ If you liked Fatskills, consider supporting us by checking out The Life Manuals You Never Got.

About | Explore | User Guide | Topics | Subjects | Doubt Solver | Career Aptitude Test | Answers | Free Tools | OSHA Basics Quiz | What Should We Know? Privacy | Terms |

Without work one finishes nothing. - Ralph Waldo Emerson© 2026 Fatskills.com

All trademarks, logos and brand names are the property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, trademarks and brands does not imply endorsement.

About | Explore | User Guide | Topics | Subjects | Doubt Solver | Career Aptitude Test | Answers | Free Tools | OSHA Basics Quiz | What Should We Know?
Privacy | Terms |

Without work one finishes nothing. - Ralph Waldo Emerson
© 2026 Fatskills.com