Risk Assessment and Management Flashcards
7 cards from real CPHR practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Risk Assessment and Management flashcards as text
A company's HR department discovers that a key employee has been sharing confidential compensation data with competitors. Which risk category does this primarily fall under?
Answer: Operational risk
Unauthorized disclosure of confidential data by an employee is an operational risk, as it stems from internal processes and human behavior failures.
When conducting a risk probability assessment, an HR manager rates a risk as 'likely' with 'significant' impact. On a standard 5x5 risk matrix, this would typically fall in which zone?
Answer: Orange (high risk)
A 'likely' probability combined with 'significant' impact typically places a risk in the high (orange) zone on a standard risk matrix, requiring prompt mitigation.
Which approach to risk treatment involves an organization choosing not to engage in an activity that creates unacceptable risk exposure?
Answer: Risk avoidance
Risk avoidance means deciding not to pursue or continue an activity because its associated risks exceed the organization's tolerance level.
An organization implements an employee wellness program to reduce workers' compensation claims. This is an example of which risk management strategy?
Answer: Risk reduction
Risk reduction (mitigation) involves taking proactive steps to lower the likelihood or impact of a risk, such as wellness programs that decrease injury-related claims.
Under the OSHA General Duty Clause, employers are required to:
Answer: Maintain a workplace free from recognized serious hazards
The OSHA General Duty Clause (Section 5(a)(1)) requires employers to furnish a workplace free from recognized hazards likely to cause death or serious physical harm.
Which risk management framework, developed by COSO, is most commonly referenced when organizations align enterprise risk management with strategic objectives?
Answer: COSO ERM Framework
The COSO Enterprise Risk Management (ERM) Framework is widely adopted for integrating risk management with governance, strategy, and performance.
A company self-insures for workers' compensation claims up to $250,000 and purchases excess insurance above that amount. This arrangement is an example of:
Answer: Risk financing through retention with transfer
Retaining risk up to a threshold (self-insurance) while transferring excess exposure to an insurer is a risk financing strategy combining retention and transfer.