CORES Risk Control Strategies & Mitigation Planning 4

Question 1

An organization maps its controls to specific risks in a Risk and Control Self-Assessment (RCSA). What is the PRIMARY purpose of this mapping?

Accepted Answer

To identify control gaps and ensure every significant risk has adequate coverage

Answer

Control mapping in an RCSA reveals where risks lack adequate coverage, enabling targeted remediation of control gaps.

Question 2

Which mitigation approach is MOST appropriate for an operational risk that is high in likelihood but low in impact?

Accepted Answer

Frequent monitoring and process-level preventive controls

Answer

High-likelihood, low-impact risks are best managed through process controls and monitoring to reduce frequency and operational disruption.

Question 3

In a risk control matrix, 'control effectiveness rating' refers to:

Accepted Answer

The degree to which a control reduces the likelihood or impact of a risk

Answer

Control effectiveness measures how well a control actually reduces risk likelihood or impact, which is the core metric in a risk control matrix.

Question 4

Third-party risk management is an extension of operational risk control because:

Accepted Answer

Outsourced activities retain the firm's operational risk exposure even when performed externally

Answer

Outsourcing transfers activities but not accountability; the firm retains operational risk exposure and must maintain oversight and controls.

Question 5

A 'compensating control' is BEST defined as:

Accepted Answer

An alternative control that mitigates risk when a primary control cannot be implemented

Answer

Compensating controls are substitutes deployed when the ideal primary control is not feasible, providing an alternative risk mitigation mechanism.

(CORES) Certified Operational Risk Executive Specialist Practice Test