When Should Risk Assessment Occur Before a Business Case?
Short answer
A Conduct a risk assessment to quantify organizational threats before building the financial justification.
Question
Key Takeaways
Tests the proper sequence in security governance: understanding organizational risk must precede justifying investments through a business case.
Developing a business case for a security initiative requires first conducting a risk assessment to justify the need. The CISM community consensus confirms that risk assessment precedes business case development.
Common mistake: Cost-benefit analysis (C) is frequently chosen incorrectly because candidates confuse a required component of the business case with a prerequisite step.
Expert Analysis
Why the Answer Is Correct
In CISM methodology, a risk assessment must precede business case development because it identifies existing threats, vulnerabilities, and potential business impacts. This foundational data justifies why the security initiative is necessary and aligns it with organizational risk appetite. As noted in community feedback, the risk assessment provides the essential evidence and context needed to build a solid, risk-aligned business case. Without this step, any proposed initiative lacks strategic justification.
Why the Other Options Are Wrong
Cost-benefit analysis (C) is a core component of the business case itself, not a precursor; attempting it beforehand creates circular logic without knowing the underlying risks. Benchmarking exercises (B) help select appropriate controls but occur after the initiative's necessity is established. Identifying resource requirements (D) belongs to project planning and budgeting, which only happens once the business case secures executive approval.
Community Comment Notes
Several candidates debated between risk assessment and cost-benefit analysis, highlighting a common sequencing confusion. Commenters correctly pointed out that cost-benefit calculations depend entirely on quantified risk data derived from the initial assessment. Others emphasized that ISACA explicitly structures governance workflows to move from risk identification to business justification, reinforcing option A as the definitive first step.
Official Reference
- https://www.isaca.org/credentialing/cism
- https://www.isaca.org/resources/isaca-journal/past-issues/2018/volume-4/cism-exam-preparation-tips
These links open the official vendor documentation in a new tab.
Exam Strategy
Always follow ISACA’s governance lifecycle when sequencing tasks: assess risk before justifying investment. Financial evaluations like cost-benefit analysis belong inside the business case, not before it.
Frequently Asked Questions
Why isn't cost-benefit analysis done first?
How does benchmarking fit into the timeline?
Community Votes
67% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 5 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 5
-
Josef4CISM 👍 3 Answered CMy take is: A security initiative is the result of a risk assessment. E.g., the security initiative could mean the implementation of a SIEM as a mitigating control. Therefore, a risk assessment is given already. To decide whether certain controls should be implemented, a cost-benefit analysis must be done. If costs outweigh benefits, there is no need to write a business case. If benefits outweigh costs, the cost-benefit analysis will be part of the business case later on.
-
Pichon 👍 2 Answered A1 step is a risk assessment; then on the business case, you need to do a risk cost analysis after you analyze the risks.
-
PluDou_111 👍 1 Answered ARA, The correct answer is: A. Conduct a risk assessment Explanation: Before developing a business case for a new security initiative, a risk assessment should be conducted to identify potential threats, vulnerabilities, and the impact on the organization. This helps in determining whether the initiative is necessary and aligns with the organization’s risk management strategy. • B. Conduct a benchmarking exercise – This can provide useful insights but is typically done after understanding the organization’s specific risks. • C. Perform a cost-benefit analysis – This is part of the business case development and comes after identifying risks and determining the need for the initiative. • D. Identify resource requirements – This is a later step after establishing the justification for the initiative. By conducting a risk assessment first, the organization ensures that the security initiative is driven by actual business and security needs rather than assumptions.
-
SHERLOCKAWS 👍 1 Answered AAnswer is A: Because it provides the evidence and context needed to build a solid, risk-aligned business case for any new security initiative. cost benefit analysis is in the business case.
-
ServerBrain 👍 2 Answered AA. Conduct a risk assessment
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All CISM Questions
Access 400 questions with complete answers and detailed explanations.
View Full CISM Practice Test →