EXIN Lean IT Foundation common mistakes
EXIN Lean IT Foundation · Understand the traps and how to avoid them.
Removing every non-value-adding step without checking necessary controls.
An isolated metric, label or approval does not establish the complete actual service, risk and authority conditions.
What to do instead
Distinguish avoidable waste from required safety, legal and organizational enabling work.
Increasing one team’s utilization while customer waiting grows.
A local activity measure can hide worse end-to-end lead time, extra handoffs or rework.
What to do instead
Measure the full stream and validate downstream effects.
Treating the fifth why or a Pareto label as proof of a cause.
An isolated metric, label or approval does not establish the complete actual service, risk and authority conditions.
What to do instead
Validate hypotheses with relevant process and outcome evidence.
Skipping the baseline because the proposed solution seems obvious.
Without a useful baseline and measurement definition, an observed change may not establish the intended improvement.
What to do instead
Define the problem and measures, then test the causal hypothesis with relevant evidence.
Using a sigma or percentage without its assumptions and denominator.
An isolated metric, label or approval does not establish the complete actual service, risk and authority conditions.
What to do instead
State the actual definition, population, units, stability and model before interpreting the number.
Treating specification limits as statistical control limits.
Requirements and a model of observed process variation answer different questions; a stable process can still fail requirements.
What to do instead
Interpret the two boundaries separately and inspect the stated measurement assumptions.
Choosing the answer that describes the 'best practice' control rather than the answer that reflects what the business has decided it can tolerate.
Candidates transfer an audit or security-engineering mindset into CRISC, where the risk practitioner's job is to inform and enable a business decision, not to impose the safest option. Options containing words like 'eliminate', 'ensure', 'mandate', or 'all risk is avoided' feel rigorous but are usually wrong.
What to do instead
Before answering, classify the question: is it asking what the risk practitioner should DO next, or what the business should DECIDE? If the stem involves tolerance, appetite, or trade-offs, eliminate any option that removes the business's choice and prefer the option that quantifies, communicates, and escalates.
Jumping to a response (mitigate, transfer, avoid, accept) before establishing or confirming the risk context and performing the assessment.
Experienced practitioners recognise the response immediately in the scenario and answer it, skipping the earlier step the question actually asks about. CRISC questions are sequence-sensitive; the 'next' step is almost always the earliest incomplete step in the risk process.
What to do instead
Apply a fixed sequence check on every stem: identify/context, then analyse/assess, then evaluate against appetite, then respond, then monitor and report. Ask 'what has explicitly already happened in this stem?' and select the first action that comes after it.
Choosing quantitative risk analysis over qualitative without testing whether the data needed for quantification exists or whether the decision requires it.
Quantification is presented as more mature, so candidates assume it is always the better answer. In practice, forcing quantification on sparse or unreliable data produces false precision and is a poor recommendation.
What to do instead
Ask what data is available and what decision is being made. If the stem shows missing historical data, a novel risk, or a fast screening decision, select qualitative or semi-quantitative; select quantitative when reliable loss data or actuarial input exists and the decision involves material financial trade-offs.