CRISC Certified in Risk and Information Systems Control – Question153 - CRISC Certified in Risk and Information Systems Control

You are completing the qualitative risk analysis process with your project team and are relying on the risk management plan to help you determine the budget, schedule for risk management, and risk categories. You discover that the risk categories have not been created. When the risk categories should have been created?

A. Define scope process
B. Risk identification process
C. Plan risk management process
D. Create work breakdown structure process

Correct Answer: C

Explanation:

Explanation:
The plan risk management process is when risk categories were to be defined. If they were not defined, as in this scenario, it is acceptable to define the categories as part of the qualitative risk analysis process. Plan risk management is the process of defining the way to conduct the risk management activities. Planning is essential for providing sufficient resources and time for risk management activities, and to establish an agreed-upon basis of evaluating risks. This process should start as soon as project is conceived and should be completed early during project planning.
Incorrect Answers:
A: Risk categories are not defined through the define scope process.
B: Risk categories are not defined through the risk identification process.
D: Risk categories are not defined through the create work breakdown structure process.