Change Management Risk Assessment & Management 5 — Questions and Answers
Question 1: A change is deemed 'standard' in an ITIL framework. What risk characteristic typically qualifies it as standard?
- It has been formally escalated to the CAB for review
- It is low risk, well-understood, and follows a pre-approved procedure (Correct answer)
- It requires a full business impact analysis before approval
- It involves significant infrastructure modification
Correct answer: It is low risk, well-understood, and follows a pre-approved procedure
Standard changes are pre-authorized because they are routine, low risk, and follow a documented procedure with a known outcome.
Question 2: What is the primary purpose of maintaining a risk log throughout the lifecycle of a change?
- To satisfy external auditors with documentation
- To provide a continuous record of risks, responses, and status for informed decision-making (Correct answer)
- To demonstrate to stakeholders that the project is on schedule
- To track the financial expenditure on risk mitigation activities
Correct answer: To provide a continuous record of risks, responses, and status for informed decision-making
A risk log serves as the living record of all identified risks, enabling ongoing visibility and informed decisions throughout the change lifecycle.
Question 3: Which factor most increases the residual risk after a mitigation strategy is applied?
- A thorough root cause analysis was conducted
- The mitigation was only partially implemented due to resource constraints (Correct answer)
- The risk was escalated to the change advisory board
- A contingency reserve was added to the project budget
Correct answer: The mitigation was only partially implemented due to resource constraints
Partial implementation of a mitigation reduces its effectiveness, leaving a larger residual risk than a fully executed response would.
Question 4: In risk management, what does 'risk velocity' refer to?
- The speed at which the project team can implement a risk response
- How quickly a risk can impact the project once it is triggered (Correct answer)
- The rate at which new risks are added to the risk register
- The frequency of risk review meetings during a change initiative
Correct answer: How quickly a risk can impact the project once it is triggered
Risk velocity measures how fast a risk can materialize and cause harm once triggered, influencing urgency of response planning.
Question 5: A change manager is reviewing a business continuity plan as part of risk management. What is its primary purpose in this context?
- To document all risks identified during the change initiative
- To ensure operations can continue if the change causes a significant disruption (Correct answer)
- To outline the communication plan for change stakeholders
- To assign risk ownership across project team members
Correct answer: To ensure operations can continue if the change causes a significant disruption
A business continuity plan ensures the organization can maintain critical functions if the change results in an unexpected disruption or failure.
Question 6: Which stakeholder group is typically responsible for setting organizational risk thresholds that govern change approval?
- The project manager and change champion
- Senior leadership and the risk governance committee (Correct answer)
- The end-user community affected by the change
- The IT helpdesk and support teams
Correct answer: Senior leadership and the risk governance committee
Risk thresholds reflect organizational strategy and are established by senior leadership and risk governance bodies, not project-level roles.
Question 7: When a change risk cannot be avoided, mitigated, or transferred, which response strategy is used as a last resort?
- Escalate
- Accept (Correct answer)
- Exploit
- Defer
Correct answer: Accept
Risk acceptance is used when other strategies are not feasible or cost-effective, acknowledging the risk and deciding to proceed without further action.
Change Management Risk Assessment & Management 5
A change is deemed 'standard' in an ITIL framework.
What risk characteristic typically qualifies it as standard?