Risk Assessment · Topic 3 of 6
Risk Scenario Development and Evaluation
CRISC risk scenarios: ISACA scenario components, top-down and bottom-up approaches, generic versus tailored scenarios, and testing them with stakeholders.
- 5 min
- Includes a diagram
- Scenario components: actor, threat type, event, asset or resource, and time.
- Top-down starts from objectives; bottom-up starts from threats and generic lists; use both.
- Generic scenarios must be tailored to the organization.
What it is
A risk scenario is a short, concrete description of how a risk could happen: who or what causes it, what happens, which asset is affected, and what the business impact would be. Scenarios turn vague worries such as "cyber risk" into something that can be analysed, owned and treated.
The job practice asks the practitioner to evaluate threats, vulnerabilities and risk to create information system risk scenarios, then analyse them to produce a risk rating.
How it works
Components of a scenario
ISACA's Risk IT guidance describes scenarios with these elements:
| Component | Question it answers | Example |
|---|---|---|
| Actor | Who or what causes it? | External criminal group, employee, supplier, nature |
| Threat type | What is the nature of the event? | Malicious, accidental, failure, natural, legal |
| Event | What happens? | Disclosure, interruption, modification, theft, destruction, ineffective design |
| Asset or resource | What is affected? | People, processes, infrastructure, applications, information |
| Time | When and for how long? | Timing, duration, time to detect, time lag before impact |
A complete scenario reads naturally: "An external criminal group encrypts the order management system and its backups, stopping order processing for three days during peak season and causing lost sales and customer complaints."
Top-down and bottom-up
| Approach | Starting point | Strength |
|---|---|---|
| Top-down | Business objectives and what could stop them | Clearly linked to business impact and easy for executives to understand |
| Bottom-up | Generic scenario lists, known threats and vulnerabilities | Thorough; less likely to miss technical risks |
Good practice combines both. Top-down keeps scenarios relevant; bottom-up checks nothing important is missing.
Generic and tailored scenarios
Generic scenario libraries are a useful starting point but must be tailored to the organization's business, technology and threat landscape. A scenario that does not apply should be removed, and new ones added for unique risks.
Too many scenarios become unmanageable; too few miss real exposure. Aim for a set that covers the main risks with enough detail to analyse.
Who builds them
Scenarios are built in workshops with business process owners, IT, security, and sometimes legal and finance. Business owners bring impact knowledge; technical staff bring threat and vulnerability knowledge. The practitioner facilitates and documents.
Evaluating scenarios
Each scenario is checked for being realistic, relevant to objectives, specific enough to rate, and consistent with past events and current threats. It is then analysed for likelihood and impact, compared with appetite, and entered in the risk register.
Tabletop exercises test scenarios against real capabilities. Walking through a scenario often shows that detection or recovery would take longer than assumed, which changes the rating. Scenarios should also be reviewed when the threat landscape, technology or business changes.
Scenario dependencies
Scenarios can be linked. A cloud provider outage may trigger several scenarios at once across different processes. Recording common causes helps the practitioner see aggregated or concentrated risk that would be missed when scenarios are rated one by one.
A worked example
A logistics company holds a top-down workshop. The operations director says the key objective is on-time delivery. The group builds a scenario: a ransomware attack by an external actor encrypts the route planning system, halting dispatch for two days.
The bottom-up review adds a second scenario that the workshop missed: an accidental misconfiguration by the cloud team deletes the planning database, with backups only every 24 hours. In a later tabletop, the team discovers backups are stored in the same cloud account as production, so the ransomware scenario's impact is rated higher.
How the exam asks about this
- "What is the PRIMARY benefit of a top-down approach to scenario development?" Scenarios are directly linked to business objectives and impact.
- "Generic risk scenarios have been obtained from an industry library. What should the practitioner do NEXT?" Tailor them to the organization's business, environment and threats.
- "Who should be involved in developing IT risk scenarios?" Business process owners together with IT and security specialists.
What to remember for the exam
- Scenario components: actor, threat type, event, asset or resource, and time.
- Top-down starts from objectives; bottom-up starts from threats and generic lists; use both.
- Generic scenarios must be tailored to the organization.
- Business owners must take part, because they understand impact.
- Tabletop exercises reveal gaps between assumed and real capabilities.
A scenario with no business impact is not finished. If an option describes only a technical event, the BEST improvement is to express its effect on business objectives.
Common mistakes
Copying a generic library unchanged. It wastes effort on irrelevant risks and misses unique ones.
Writing scenarios only with IT. Without business owners, impact estimates are guesses.
Rating linked scenarios separately. Shared causes can create concentrated risk that only shows when scenarios are viewed together.
Check yourself
What are the five components of an ISACA risk scenario?
Actor, threat type, event, asset or resource, and time.
Why combine top-down and bottom-up approaches?
Top-down keeps scenarios tied to objectives, while bottom-up checks that relevant technical threats and vulnerabilities are not missed.
How does a tabletop exercise improve a risk scenario?
It tests the scenario against real response capabilities and often reveals gaps that change the likelihood or impact rating.
Topic 3 of 6 in Risk Assessment
Test yourself on Risk Assessment
The full ISACA CRISC question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.