How Do You Predict Business Impact Probability from Cooling Failures?

CRISC By islever Editorial Last updated

Short answer

D Applicable threats

Question

A risk practitioner discovers that a data center's air conditioning system cannot provide sufficient cooling. What else is MOST important to consider when predicting the probability of adverse business impact from this issue?
  1. Maintenance history
  2. Compensating controls
  3. Replacement cost
  4. Applicable threats Correct Answer

Key Takeaways

Tests the link between threat identification and likelihood estimation, while trapping candidates who confuse probability assessment with mitigation strategies or financial metrics.

This CRISC practice question evaluates your ability to assess risk probability during critical infrastructure failures. Industry consensus and exam feedback confirm that identifying applicable threats is the most effective method for forecasting potential business disruptions.

Common mistake: Compensating controls (B) is the most frequent incorrect choice, as candidates mistakenly prioritize immediate remediation over the foundational step of analyzing threat sources that drive failure probability.

Expert Analysis

Why the Answer Is Correct

In formal risk management frameworks like those promoted by ISACA and NIST, probability (or likelihood) is fundamentally derived from the interaction of threat sources and existing vulnerabilities. By identifying applicable threats—such as extreme weather events, utility failures, or cascading hardware malfunctions—a risk practitioner can model how frequently the cooling deficiency might be exploited or triggered. This threat-centric approach directly informs the statistical or qualitative forecasting required to estimate the chance of adverse business impact before any controls are applied.

Why the Other Options Are Wrong

Maintenance history (A) provides retrospective data but does not actively project future threat frequencies or environmental stressors that influence likelihood. Compensating controls (B) are designed to reduce either the probability or impact of a risk event, making them a mitigation tool rather than a predictive analytical factor. Replacement cost (C) is purely a financial metric tied to risk impact and recovery objectives, completely unrelated to calculating the probability of occurrence.

Community Comment Notes

High-ranking community feedback strongly validates threat analysis as the correct approach. Contributors emphasize that mapping specific threats such as overheating and hardware failure enables precise likelihood forecasting [1][2]. Although one user selected compensating controls, the prevailing consensus correctly distinguishes between predictive risk analysis and subsequent mitigation planning [3].

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When CRISC questions ask about predicting "probability" or "likelihood," immediately anchor your reasoning to threat sources and vulnerability exposure. Resist the pull of mitigation-focused answers like compensating controls, as they address risk treatment rather than initial risk estimation. Always separate probability forecasting from impact valuation and financial calculations to select the most analytically sound option.

Community Votes

D
67%
B
33%

67% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. K5000ism 👍 1 Answered D
    D. Applicable threats Understanding the potential threats, such as overheating, equipment failure, or downtime, is crucial for assessing the likelihood of adverse impacts. Identifying and analyzing the specific threats associated with the cooling system issue will provide a more targeted and risk-informed assessment.
  2. faed87a 👍 1 Answered D
    Considering the applicable threats (such as overheating, hardware failure, and system outages) is essential in predicting the probability of adverse business impact from a failure in the air conditioning system.
  3. CANDOO 👍 1 Answered B
    B is the right answer

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Why Test a Modified Disaster Recovery Plan?

S-grade

Which Process Determines Threat Relevance for Risk Scenarios?

S-grade

How to Best Prove Implemented Controls Reduce IT Risk?

S-grade

Best Approach to Assess Identified Risk Events in Projects?

S-grade

Practice All CRISC Questions

Access 332 questions with complete answers and detailed explanations.

View Full CRISC Practice Test →

← Back to CRISC Study Guide