CORES Risk Control Strategies & Mitigation Planning 5

Question 1

A risk manager is evaluating two controls for the same risk: Control A reduces likelihood by 70% at a cost of $50K; Control B reduces impact by 80% at a cost of $200K. Which factor should MOST influence the selection?

Accepted Answer

The nature of the risk — whether preventing occurrence or limiting damage is more valuable

Answer

The appropriate control depends on whether the risk profile benefits more from frequency reduction or severity reduction, which is context-specific.

Question 2

In operational risk, 'inherent risk' differs from 'residual risk' in that:

Accepted Answer

Inherent risk is the exposure before controls; residual risk is what remains after controls are applied

Answer

Inherent risk is the raw risk exposure without controls; residual risk is what remains after the organization's controls have been applied.

Question 3

When updating a risk mitigation plan after a significant operational loss event, which step should occur FIRST?

Accepted Answer

Conduct a root-cause analysis to understand why existing controls failed

Answer

Root-cause analysis is essential first because it identifies the specific control failure or gap, informing targeted remediation rather than generic responses.

Question 4

A 'heat map' in risk management is used to prioritize mitigation efforts by plotting risks according to:

Accepted Answer

Likelihood and impact, visually highlighting the highest-priority risks

Answer

A risk heat map plots likelihood on one axis and impact on the other, enabling visual prioritization of risks requiring the most urgent mitigation.

Question 5

Which scenario represents a failure of the 'defense-in-depth' principle in operational risk control design?

Accepted Answer

Relying solely on a single automated system to manage all fraud risks

Answer

Defense-in-depth requires multiple independent control layers; relying on a single control creates a single point of failure that violates this principle.

(CORES) Certified Operational Risk Executive Specialist Practice Test

(CORES) Certified Operational Risk Executive Specialist Practice Test

CORES Risk Control Strategies & Mitigation Planning 5