CPL CPL Risk Management & Compliance 1 — Questions and Answers
Question 1: In program risk management, what is the primary difference between a risk and an issue?
- A risk is always negative, while an issue can be positive or negative
- A risk is an uncertain future event, while an issue is a risk that has already occurred (Correct answer)
- A risk requires a mitigation plan, while an issue requires a contingency plan
- A risk affects the entire program, while an issue only affects a single project
Correct answer: A risk is an uncertain future event, while an issue is a risk that has already occurred
A risk is an uncertain future event that may impact the program, whereas an issue is a risk event that has already materialized and requires immediate action.
Question 2: Which risk response strategy involves shifting the negative impact of a risk to a third party, such as through insurance or outsourcing?
- Avoid
- Mitigate
- Transfer (Correct answer)
- Accept
Correct answer: Transfer
Risk transfer shifts the financial or operational consequence of a risk to another party, though it does not eliminate the risk itself.
Question 3: A program manager is assessing risks by multiplying probability by impact to prioritize them. This technique is referred to as:
- Monte Carlo simulation
- Probability and Impact Matrix analysis (Correct answer)
- Risk breakdown structure analysis
- Delphi technique
Correct answer: Probability and Impact Matrix analysis
The Probability and Impact Matrix multiplies the likelihood of a risk occurring by its potential impact to rank and prioritize risks for response planning.
Question 4: Which of the following BEST describes a residual risk in program management?
- A risk that has been fully eliminated through mitigation
- A new risk created as a result of implementing a risk response
- A risk that remains after risk responses have been implemented (Correct answer)
- A risk that has been escalated to the program sponsor
Correct answer: A risk that remains after risk responses have been implemented
Residual risks are those that remain after mitigation or other responses have been applied and must continue to be monitored throughout the program.
Question 5: A program manager discovers that a new federal regulation will require significant changes to several component projects. This is BEST classified as which type of risk?
- Operational risk
- Schedule risk
- Compliance risk (Correct answer)
- Reputational risk
Correct answer: Compliance risk
Compliance risk arises from potential violations of laws, regulations, or standards, and regulatory changes that affect program delivery fall squarely into this category.
Question 6: What is the purpose of a risk register in program management?
- To document approved budget for managing identified risks
- To record identified risks, their analysis, and planned responses (Correct answer)
- To track issues that have already occurred and their resolution status
- To assign financial reserves for unknown risks
Correct answer: To record identified risks, their analysis, and planned responses
The risk register is a central document that captures identified risks, their probability and impact scores, owners, and planned response strategies.
CPL CPL Risk Management & Compliance 1
In program risk management, what is the primary difference between a risk and an issue?