The most important reason to create risk scenarios is to assist with risk identification. Risk scenarios are hypothetical situations that describe how a risk event could occur and what the consequences would be. By creating risk scenarios, the enterprise can identify potential sources, causes, and impacts of risk, as well as the likelihood and severity of the risk. Risk scenarios also help to communicate and visualize the risk to stakeholders and decision makers. Determiningrisk tolerance, risk appetite, and risk responses are important outcomes of risk scenarios, but they are not the primary reason for creating them. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 2, Section 2.1.1.2, page 521

1: ISACA Certified in Risk and Information Systems Control (CRISC®) Exam Guide, Answer to Question 639.