Question

A CRISC-certified risk analyst is reviewing a business unit's qualitative risk assessment. Twelve individually low-likelihood, low-impact risks all relate to the same aging legacy database platform. Each is plotted separately in the green zone of the heat map, so management has declined to fund any remediation. The analyst believes the true exposure is understated. Which action would MOST effectively address this concern?

Accepted Answer

Aggregate the related risks into a single scenario reflecting their common source before re-rating likelihood and impact

Answer

Escalate each of the twelve risks individually to the enterprise risk committee for reconsideration

Answer

Convert all twelve qualitative ratings to quantitative ALE values to force a higher priority score

Answer

Increase each individual risk's impact rating by one level to move them into the amber zone