How Do You Predict Business Impact Probability from Cooling Failures?
A risk practitioner discovers that a data center's air conditioning system cannot provide sufficient cooling. What else is MOST important to consider when predicting the probability of adverse business impact from this issue?
Community Votes
67% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
Tests the link between threat identification and likelihood estimation, while trapping candidates who confuse probability assessment with mitigation strategies or financial metrics.
This CRISC practice question evaluates your ability to assess risk probability during critical infrastructure failures. Industry consensus and exam feedback confirm that identifying applicable threats is the most effective method for forecasting potential business disruptions.
Compensating controls (B) is the most frequent incorrect choice, as candidates mistakenly prioritize immediate remediation over the foundational step of analyzing threat sources that drive failure probability.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
In formal risk management frameworks like those promoted by ISACA and NIST, probability (or likelihood) is fundamentally derived from the interaction of threat sources and existing vulnerabilities. By identifying applicable threats—such as extreme weather events, utility failures, or cascading hardware malfunctions—a risk practitioner can model how frequently the cooling deficiency might be exploited or triggered. This threat-centric approach directly informs the statistical or qualitative forecasting required to estimate the chance of adverse business impact before any controls are applied.Why the Other Options Are Wrong
Maintenance history (A) provides retrospective data but does not actively project future threat frequencies or environmental stressors that influence likelihood. Compensating controls (B) are designed to reduce either the probability or impact of a risk event, making them a mitigation tool rather than a predictive analytical factor. Replacement cost (C) is purely a financial metric tied to risk impact and recovery objectives, completely unrelated to calculating the probability of occurrence.Community Comment Notes
High-ranking community feedback strongly validates threat analysis as the correct approach. Contributors emphasize that mapping specific threats such as overheating and hardware failure enables precise likelihood forecasting [1][2]. Although one user selected compensating controls, the prevailing consensus correctly distinguishes between predictive risk analysis and subsequent mitigation planning [3].Official Reference
Exam Strategy
When CRISC questions ask about predicting "probability" or "likelihood," immediately anchor your reasoning to threat sources and vulnerability exposure. Resist the pull of mitigation-focused answers like compensating controls, as they address risk treatment rather than initial risk estimation. Always separate probability forecasting from impact valuation and financial calculations to select the most analytically sound option.
Related Analysis
Practice All CRISC Questions
Access 332 questions with complete answers and detailed explanations.
View Full CRISC Practice Test →