Which Risk Rating Is Most Affected by Understaffing?

CRISC By islever Editorial Last updated

Short answer

C Likelihood rating

Question

A risk practitioner observes that the network team responsible for maintaining the network infrastructure is severely understaffed, which could lead to operational losses. Which of the following is MOST directly affected by the risk practitioner's observation?
  1. Inherent risk
  2. Impact rating
  3. Likelihood rating Correct Answer
  4. Control risk

Key Takeaways

Tests your ability to differentiate risk components, with the common trap being confusing increased probability (likelihood) with increased severity (impact) or control effectiveness.

In CRISC risk assessments, resource constraints like severe understaffing primarily increase the probability of operational failures. The community unanimously agrees that this observation most directly impacts the likelihood rating rather than impact or control risk.

Common mistake: Candidates frequently select Control risk or Impact rating, mistakenly believing that understaffing represents a control failure or assumes it amplifies the financial consequences of an outage rather than the probability of it occurring.

Expert Analysis

Why the Answer Is Correct

Understaffing directly reduces an organization’s capacity to monitor, maintain, and respond to threats, which inherently raises the probability of a risk event materializing. In ISACA’s risk assessment methodology, factors that influence frequency or probability are explicitly evaluated under the likelihood rating. Consequently, identifying personnel shortages allows the risk practitioner to quantitatively or qualitatively adjust the likelihood score upward to reflect heightened vulnerability.

Why the Other Options Are Wrong

Inherent risk reflects the natural level of risk before any controls are applied and remains unchanged by current operational staffing levels. Impact rating measures the potential magnitude of loss or damage, which stays constant regardless of whether the team is adequately staffed to prevent incidents. Control risk focuses on the design and implementation adequacy of safeguards, whereas understaffing primarily degrades ongoing execution capacity rather than altering the fundamental control design.

Community Comment Notes

The community demonstrates unanimous consensus on option C, with multiple high-voted comments reinforcing that reduced staffing elevates the probability of disruptions. Comment [1] correctly defines likelihood rating as the probability or frequency of a risk event, directly linking it to the operational scenario. Comment [2] emphasizes that an inability to maintain infrastructure naturally raises the chance of outages, solidifying the likelihood connection. Comment [3] serves as a straightforward confirmation of the correct choice without adding further analytical depth.

Official Reference

https://www.isaca.org/resources/isaca-journal/past-issues/2017/volume-6/what-is-inherent-risk-and-residual-risk

This link opens the official vendor documentation in a new tab.

Exam Strategy

When evaluating risk scenarios, always separate probability drivers from consequence drivers. Resource shortages, outdated technology, and high threat activity increase likelihood, while asset criticality, data sensitivity, and regulatory exposure dictate impact. Memorizing these distinct categories prevents swapping likelihood and impact during timed exam conditions.

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. Abbey2 👍 2 Answered C
    The observation by the risk practitioner that the network team responsible for maintaining the network infrastructure is severely understaffed, which could lead to operational losses, most directly affects the: C. Likelihood rating. The likelihood rating in risk management refers to the probability or frequency of a risk event occurring. In this scenario, the understaffing of the network team increases the likelihood of incidents related to network maintenance, such as system downtime or security breaches, due to insufficient resources to manage and support the network infrastructure effectively. This situation directly elevates the probability of risk realization, impacting the likelihood rating.
  2. K5000ism 👍 1
    C. Likelihood rating If the team is unable to adequately manage and maintain the network infrastructure, it raises the probability of operational disruptions, outages, or other issues that could lead to losses.
  3. K5000ism 👍 1 Answered C
    Answer is C

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Why Test a Modified Disaster Recovery Plan?

S-grade

Which Process Determines Threat Relevance for Risk Scenarios?

S-grade

How to Best Prove Implemented Controls Reduce IT Risk?

S-grade

Best Approach to Assess Identified Risk Events in Projects?

S-grade

Practice All CRISC Questions

Access 332 questions with complete answers and detailed explanations.

View Full CRISC Practice Test →

← Back to CRISC Study Guide