Certification Flashcards

Which of the following justifications for keeping key risk indicators (KRIs) is the MOST crucial?

Answer: Threats and vulnerabilities change over time

Key Risk Indicators (KRIs) are crucial because the risk landscape is dynamic; threats, vulnerabilities, and business contexts constantly evolve. Monitoring KRIs allows organizations to detect changes in their risk exposure in real-time or near real-time, enabling proactive adjustments to risk management strategies before incidents occur. This continuous monitoring is essential for adapting to an ever-changing threat environment.

You are in charge of an HGT project that just completed the final compilation phase. The project customer has approved the completion of the project, and you only need to complete a few administrative closure tasks. There were a number of significant risks in the project that might have destroyed it, but you and your project team discovered some innovative ways to address the risks without compromising the project's expenses or completion schedule. What should you do with the risk reactions you discovered throughout the monitoring and controlling procedure for the project?

Answer: Include the risk responses in the organization's lessons learned database.

The project is completing, and innovative risk responses were discovered. These successful strategies represent valuable organizational knowledge that should be captured for future reference. The organization's lessons learned database is the appropriate repository for documenting such insights, ensuring that future projects can benefit from these innovations and avoid similar risks or apply similar successful responses.

You are in charge of the GHT project. On your project, you've identified a risk event that, if it materializes, might prevent $100,000 in project expenditures. Which of the following best sums up this risky event?

Answer: This risk event is an opportunity for the project and should be exploited.

A risk event that prevents $100,000 in project expenditures is a positive outcome, as it represents a cost saving. In risk management, positive risks are referred to as opportunities. The appropriate response strategy for an opportunity with significant potential benefit, like this one, is often to 'exploit' it, meaning to take proactive steps to ensure the opportunity materializes and its benefits are fully realized.

You are in charge of managing a sizable building project. The completion of this project will cost $750,000 and take 18 months. Before the project work starts, you are collaborating with your project team, specialists, and stakeholders to identify project risks. Management is curious as to why you have so many risk identification meetings scheduled throughout the project as opposed to just at the beginning, during project planning. What makes the duplicate risk identification sessions the most effective?

Answer: The project manager and the risk identification participants can identify recently found risk events throughout the project thanks to the iterative sessions.

Risk identification is an iterative and ongoing process throughout a project's lifecycle, not a one-time event. As a project progresses, new risks can emerge, existing risks can change in probability or impact, and previously unidentified risks may become apparent. Iterative meetings ensure the project team continuously monitors the environment and identifies these new or evolving risk events, allowing for timely planning and response.

Which of the following applications of KRIs is THE MOST crucial?

Answer: Providing an early warning signal

Key Risk Indicators (KRIs) are crucial because they provide an early warning signal of increasing risk exposure. They are forward-looking metrics designed to help organizations anticipate potential problems before they escalate into actual incidents or losses. This proactive insight allows for timely intervention and risk mitigation, making the early warning signal their most critical application.

Which of the following role holders will determine the enterprise's Key Risk Indicator?

Answer: Business leaders

Business leaders are primarily responsible for determining an enterprise's Key Risk Indicators (KRIs) because they define the strategic objectives and understand the critical risks that could impact business performance. KRIs are directly tied to business goals and risk appetite, which are established and overseen by these leaders. While senior management is broadly involved, business leaders specifically drive the identification of these critical metrics.

What is an illustration of a non-technical control from the list below?

Answer: Physical security

Non-technical controls are security measures that do not rely on technology or software. Physical security, which includes measures like locks, guards, fences, and surveillance cameras, protects assets through physical means. In contrast, access control, encryption, and intrusion detection systems are all examples of technical controls that utilize software or hardware to enforce security.