CISRM common mistakes
CISRM · Understand the traps and how to avoid them.
Treating inherent risk, residual risk, and target risk as interchangeable labels, so answers describe a control-adjusted exposure as 'inherent' or quote a post-treatment figure as the current risk position.
Everyday risk language collapses the three concepts, and candidates answer from intuition rather than from the definitional chain: inherent (no controls) → residual (current controls) → target (desired after planned treatment). Questions rarely define the terms because the exam assumes them.
What to do instead
Before answering, write the three terms in the margin with their one-line definitions and identify which stage the stem describes by looking for control language ('existing controls', 'after mitigation', 'acceptable level'). If the stem says controls are in place, the answer is residual, never inherent.
Selecting the treatment option that 'reduces' risk when the stem describes risk that is within appetite, or transferring risk when the exposure is a reputational or regulatory one that cannot be insured.
Candidates memorize the four treatments (avoid, mitigate, transfer, accept) as a list rather than as a decision driven by risk appetite and by whether the risk is transferable in principle. Insurance and contracts feel like the 'safe' answer.
What to do instead
Apply a two-step filter: first ask whether the assessed risk exceeds appetite (if not, acceptance is correct and must be documented); then ask whether a third party can actually bear the loss (financial and liability risks transfer; reputational, criminal, and regulatory risks generally do not).
Ranking risks by raw likelihood-times-impact scores without applying the organization's defined risk criteria, thresholds, or appetite, and ignoring that a qualitative 'high' may already exceed tolerance.
Candidates treat scoring as arithmetic and forget that evaluation is a comparison against criteria, not a ranking exercise. Stems that supply appetite statements or tolerance thresholds are often read as background rather than as the deciding fact.
What to do instead
In any prioritization question, locate the criteria first: appetite statement, tolerance limit, or scoring scale definitions. Then check whether the question asks for assessment (what is the level?) or evaluation (is it acceptable and what do we do?). Answers that rank without referencing the criteria are usually wrong.
Confusing asset inventory attributes with risk register attributes, for example assigning an owner, criticality, and classification to a risk entry, or recording likelihood and impact against a configuration item.
Both artifacts use similar fields (owner, criticality, description), and candidates who have not built either artifact answer by pattern-matching vocabulary instead of by artifact purpose.
What to do instead
Anchor each artifact to its purpose: the asset inventory answers 'what do we have and how important is it' (owner, classification, criticality, dependencies); the risk register answers 'what could happen and what are we doing about it' (cause, event, consequence, likelihood, impact, treatment, owner, due date, status). Match the field to the purpose.
Describing monitoring as a periodic review activity only, missing that key risk indicators, control testing, and trigger thresholds are the mechanisms that make monitoring continuous and that feed reporting.
Review cycles are the most visible part of monitoring, so candidates equate the two and overlook KRIs and control effectiveness testing, which the exam tests as distinct components.
What to do instead
Memorize monitoring as three layers: indicators (KRIs with thresholds and escalation triggers), control assurance (testing design and operating effectiveness), and periodic reassessment. When a stem asks how to detect a changing risk profile early, the answer is an indicator with a threshold, not a more frequent review meeting.
Treating third-party risk as a procurement step that ends at contract signature, so due diligence is selected as the answer for ongoing exposure and contract clauses are assumed to eliminate residual risk.
Vendor onboarding is the most familiar part of the lifecycle, and candidates conflate 'we assessed them' with 'we manage them'. Contracts are also mistaken for controls rather than for allocation of consequences.
What to do instead
Map the third-party lifecycle explicitly: due diligence before engagement, contractual controls at engagement, ongoing monitoring (attestations, questionnaires, SLA reporting, concentration tracking) during the relationship, and exit planning. If the stem describes a live relationship, the answer is a monitoring or concentration activity, not onboarding.
Answering compliance questions with the control that satisfies an auditor rather than the control that satisfies the obligation, and missing that regulatory requirements set a floor that risk appetite may exceed.
Candidates study frameworks and standards more than legal obligations, so a familiar framework control becomes the default answer even when the stem cites a specific regulatory duty or notification deadline.
What to do instead
Separate the two questions: 'what does the law or regulator require?' (mandatory, with deadlines and evidence) versus 'what does our framework recommend?' (advisory). When a stem names a regulation or a breach notification window, answer from the obligation first; use framework mapping only to show how the obligation is met.
Treating business impact analysis as a risk assessment and choosing likelihood-based answers for recovery questions, or setting recovery objectives from IT capability rather than from business tolerance for downtime.
BIA and risk assessment share inputs (asset criticality, impact) but answer different questions. Candidates who have only seen templates merge them and then pick 'reduce the likelihood of outage' when the stem asks how long the business can tolerate disruption.
What to do instead
Hold the distinction: the BIA derives maximum tolerable downtime and recovery objectives from business impact over time; the risk assessment derives likelihood and consequence and drives treatment. If the stem mentions RTO, RPO, or MTD, answer from business impact and dependency mapping, not from threat likelihood.
Confusing control categories (preventive, detective, corrective) with control types (administrative, technical, physical), and selecting a detective control where the stem asks how to stop an event or a preventive control where it asks how to detect one.
The two classification schemes use overlapping vocabulary and are often presented together in study material, so candidates recall the labels but not the axis each belongs to.
What to do instead
For every control, state two independent facts: when it acts (before, during, after the event) and how it is implemented (people/process, technology, facility). Read the stem's verb: 'prevent', 'detect', 'recover' map to the first axis; 'policy', 'system setting', 'fence' map to the second. Answer on the axis the question asks about.
Treating governance as documentation, so the answer to an accountability question becomes 'update the policy' or 'document the process' rather than assigning decision rights, defining appetite, or establishing oversight with escalation.
Policy artifacts are tangible and easy to recall, while accountability structures (who decides, who accepts risk, who is informed) are abstract. Candidates default to the visible deliverable.
What to do instead
When a stem describes unclear ownership, conflicting decisions, or risk accepted without authority, answer with the governance mechanism: defined roles and decision rights, an approved appetite with delegated acceptance limits, and a reporting line with escalation criteria. Policies record these decisions; they do not substitute for them.