CAP Risk Management & Mitigation 3 — Questions and Answers
Question 1: A retail analytics model was trained on pre-pandemic sales data and now performs poorly. Which risk does this scenario primarily illustrate?
- Insufficient computing power for scoring
- Over-documentation of the modeling process
- Data or concept drift invalidating model assumptions (Correct answer)
- Excessive stakeholder engagement during framing
Correct answer: Data or concept drift invalidating model assumptions
When the underlying data-generating process changes, drift causes model performance to degrade because training assumptions no longer hold.
Question 2: Which control is most effective for mitigating the risk of unauthorized access to sensitive data during an analytics project?
- Role-based access controls combined with data encryption (Correct answer)
- Emailing datasets only to team members who request them
- Storing all data in a single shared spreadsheet
- Relying on verbal agreements about data handling
Correct answer: Role-based access controls combined with data encryption
Role-based access and encryption limit exposure of sensitive data to only authorized users, both at rest and in transit.
Question 3: Expected monetary value (EMV) analysis quantifies a risk by multiplying which two quantities?
- The mitigation cost and the project duration
- The team size and the average salary
- The probability of the risk event and its monetary impact (Correct answer)
- The project budget and the number of identified risks
Correct answer: The probability of the risk event and its monetary impact
EMV equals the probability of an event times its financial consequence, giving a quantitative expected cost or benefit.
Question 4: An analytics team builds a simpler backup model in case the primary machine learning model fails validation before a hard deadline. This is best described as what?
- Risk transfer to the validation team
- Risk avoidance by canceling the deliverable
- An uncontrolled workaround performed after risk occurrence
- A contingency plan for an identified project risk (Correct answer)
Correct answer: A contingency plan for an identified project risk
A contingency plan is a predefined fallback that activates if an identified risk materializes.
Question 5: Which of the following is a secondary risk introduced by a mitigation action?
- An analyst discovering missing values in the raw data
- A stakeholder changing project requirements mid-project
- A hurricane delaying a data center migration
- Outsourcing data cleaning to reduce schedule risk, which creates new vendor-confidentiality risk (Correct answer)
Correct answer: Outsourcing data cleaning to reduce schedule risk, which creates new vendor-confidentiality risk
A secondary risk arises directly from implementing a risk response, such as new confidentiality exposure created by outsourcing.
Question 6: Why should residual risk be documented after mitigation strategies are applied?
- Because documentation replaces the need for any further monitoring
- Because mitigation always eliminates all risk, so the register can be deleted
- Because stakeholders must understand and accept the risk that remains despite mitigation (Correct answer)
- Because residual risk only matters for hardware projects
Correct answer: Because stakeholders must understand and accept the risk that remains despite mitigation
Mitigation rarely eliminates risk entirely, so the remaining exposure must be visible for informed stakeholder acceptance and monitoring.
Question 7: During deployment, which practice best mitigates the risk of a new predictive model disrupting business operations?
- Skipping user training to shorten the timeline
- Disabling all monitoring to reduce system overhead
- Deploying to all users at once to maximize immediate value
- Phased rollout or A/B testing with the ability to roll back quickly (Correct answer)
Correct answer: Phased rollout or A/B testing with the ability to roll back quickly
Gradual rollout with rollback capability limits the blast radius if the model behaves unexpectedly in production.
CAP Risk Management & Mitigation 3
A retail analytics model was trained on pre-pandemic sales data and now performs poorly.
Which risk does this scenario primarily illustrate?