ISACA Certified in Risk and Information Systems Control Practice Mode

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose C1

  1. Risk Thresholds • A risk threshold defines the level of risk that is acceptable before action is needed. • It is usually expressed in terms of impact and probability. 2. Matrix options: • A. Risk indicator matrix – Usually shows metrics or indicators that signal risk, not thresholds. ❌ • B. Impact matrix – Shows impact levels (e.g., low, medium, high), but alone does not define thresholds. ❌ • C. Risk scenario matrix ✅ – Combines probability and impact for specific risk scenarios, and is commonly used to set thresholds for acceptable, tolerable, or intolerable risks. • D. Probability matrix – Shows likelihood of events, but does not define thresholds on its own. ❌

• Chose B1

  I would say the correct answer may be B. Not actually quite sure about what A is in general but it sounds like a typical KRI which is not typically used to define thresholds.