Section: Volume D

Using a common risk taxonomy is the most important factor to consider when creating a separate IT risk register for a large organization with regard to the existing corporate risk register, as it ensures consistency, clarity, and alignment of the IT risk identification, classification, and reporting with the corporate risk management framework and strategy. Leveraging business risk professionals, relying on generic IT risk scenarios, and describing IT risk in business terms are not the most important factors, as they are more related to the resources, inputs, or outputs of the IT risk register, respectively, rather than the structure or format of the IT risk register. References = CRISC Review Manual, 7th Edition, page 100.

The most important step when developing risk scenarios using a list of generic scenarios based on industry best practices is to validate the generic risk scenarios for relevance. The generic risk scenarios may not be applicable or suitable for the specific context, objectives, and environment of the organization. Therefore, the risk practitioner should validate the relevance of the generic risk scenarios by comparing them with the organization's risk profile, risk appetite, and risk criteria. Assessing generic risk scenarios with business users, selecting the maximum possible risk scenarios from the list, and identifying common threats causing generic risk scenarios are other steps that may be useful, but they are not as important as validating the relevance of the generic risk scenarios. References = ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, question 12; CRISC Review Manual, 6th Edition, page 215.