Risk Management & Decision-Making Flashcards
7 cards from real CME practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Risk Management & Decision-Making flashcards as text
Which framework integrates risk management with strategy-setting and performance monitoring at the enterprise level?
Answer: COSO ERM 2017
The COSO ERM 2017 framework explicitly links enterprise risk management to strategy and performance across five interrelated components.
When evaluating strategic alternatives under uncertainty, a manager using a minimax regret criterion would choose the option that:
Answer: Minimizes the maximum possible regret from a wrong choice
The minimax regret criterion selects the decision that minimizes the worst-case opportunity cost (regret) if a different alternative turns out to have been optimal.
Residual risk is best defined as:
Answer: The level of risk remaining after risk responses have been applied
Residual risk is what remains after an organization has implemented its chosen risk mitigation, transfer, or control measures.
A board requests a Key Risk Indicator (KRI) dashboard. KRIs differ from Key Performance Indicators (KPIs) because KRIs:
Answer: Provide early warning signals of increasing risk exposure
KRIs are forward-looking metrics that signal changes in risk levels before a risk event materializes, whereas KPIs measure achieved performance.
Which cognitive bias leads executives to underestimate the time and cost required to complete a project?
Answer: Planning fallacy
The planning fallacy causes decision-makers to be overly optimistic about project timelines and budgets, ignoring base rates of similar past projects.
In a risk bow-tie model, the 'knot' at the center represents:
Answer: The risk event itself
The bow-tie model uses the central knot to represent the hazardous event, with threats and preventive controls on the left and consequences and recovery controls on the right.
Under which condition is a risk acceptance strategy most appropriate for an organization?
Answer: When the cost of mitigation exceeds the expected loss from the risk
Risk acceptance is rational when the cost of addressing the risk is greater than the potential loss it could cause, making remediation economically unjustifiable.