Question

A CRISC-certified risk practitioner is assigned to lead a risk assessment for a newly acquired blockchain-based settlement platform. The practitioner has no prior experience with distributed ledger technology and is unfamiliar with the associated smart-contract risks. The board expects the assessment results in two weeks. What is the practitioner's MOST appropriate first action?

Accepted Answer

Disclose the knowledge gap to management and arrange for subject-matter expertise or additional competence before completing the assessment

Answer

Proceed with the assessment using generic IT risk templates to meet the board's deadline

Answer

Decline the assignment entirely and recommend the board hire an external blockchain consultant

Answer

Complete the assessment based on best-effort judgment and note the limitations only in an appendix