Risk Management & Mitigation Flashcards

When performing a FMEA (Failure Mode and Effects Analysis), what does the Risk Priority Number (RPN) represent?

Answer: Severity × Occurrence × Detectability

RPN = Severity × Occurrence × Detectability, providing a composite score to prioritize failure modes requiring corrective action.

A project manager asks the test team to stop testing a low-risk module to focus on a high-risk integration. This is an example of which risk response strategy?

Answer: Risk mitigation through prioritization

Reallocating testing resources from low-risk to high-risk areas is a mitigation strategy that reduces overall project risk exposure.

Which type of risk specifically arises from NOT performing sufficient testing on a software component?

Answer: Quality risk

Quality risk refers to the potential that a product does not meet its quality requirements due to insufficient testing or defect escape.

In the context of risk management, what does 'risk transference' mean in software projects?

Answer: Shifting the financial or operational consequence to a third party such as a vendor or insurer

Risk transference shifts the financial or operational burden of a risk to another party, such as through outsourcing or insurance.

Which testing technique is MOST effective at identifying risks caused by interactions between integrated components?

Answer: Integration testing

Integration testing specifically targets interface and interaction defects between components, which are a primary source of integration risk.

A quality risk assessment reveals that a payment gateway has HIGH impact but LOW probability of failure. How should this risk be handled?

Answer: Test it thoroughly because the impact justifies the effort

High-impact risks warrant thorough testing regardless of low probability because a single failure can be catastrophic.

Which document formally records the decisions made about risk responses and the person accountable for each risk?

Answer: Risk register

The risk register is the authoritative record of identified risks, their assessments, chosen responses, and assigned owners.