Which Risk Rating Is Most Affected by Understaffing?
A risk practitioner observes that the network team responsible for maintaining the network infrastructure is severely understaffed, which could lead to operational losses. Which of the following is MOST directly affected by the risk practitioner's observation?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
Tests your ability to differentiate risk components, with the common trap being confusing increased probability (likelihood) with increased severity (impact) or control effectiveness.
In CRISC risk assessments, resource constraints like severe understaffing primarily increase the probability of operational failures. The community unanimously agrees that this observation most directly impacts the likelihood rating rather than impact or control risk.
Candidates frequently select Control risk or Impact rating, mistakenly believing that understaffing represents a control failure or assumes it amplifies the financial consequences of an outage rather than the probability of it occurring.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Understaffing directly reduces an organization’s capacity to monitor, maintain, and respond to threats, which inherently raises the probability of a risk event materializing. In ISACA’s risk assessment methodology, factors that influence frequency or probability are explicitly evaluated under the likelihood rating. Consequently, identifying personnel shortages allows the risk practitioner to quantitatively or qualitatively adjust the likelihood score upward to reflect heightened vulnerability.Why the Other Options Are Wrong
Inherent risk reflects the natural level of risk before any controls are applied and remains unchanged by current operational staffing levels. Impact rating measures the potential magnitude of loss or damage, which stays constant regardless of whether the team is adequately staffed to prevent incidents. Control risk focuses on the design and implementation adequacy of safeguards, whereas understaffing primarily degrades ongoing execution capacity rather than altering the fundamental control design.Community Comment Notes
The community demonstrates unanimous consensus on option C, with multiple high-voted comments reinforcing that reduced staffing elevates the probability of disruptions. Comment [1] correctly defines likelihood rating as the probability or frequency of a risk event, directly linking it to the operational scenario. Comment [2] emphasizes that an inability to maintain infrastructure naturally raises the chance of outages, solidifying the likelihood connection. Comment [3] serves as a straightforward confirmation of the correct choice without adding further analytical depth.Official Reference
Exam Strategy
When evaluating risk scenarios, always separate probability drivers from consequence drivers. Resource shortages, outdated technology, and high threat activity increase likelihood, while asset criticality, data sensitivity, and regulatory exposure dictate impact. Memorizing these distinct categories prevents swapping likelihood and impact during timed exam conditions.
Related Analysis
Practice All CRISC Questions
Access 332 questions with complete answers and detailed explanations.
View Full CRISC Practice Test →