CPS Risk Management & Mitigation 2 — Questions and Answers
Question 1: In risk management, what does a 'risk register' primarily serve to document?
- A list of approved vendors
- Identified risks, their likelihood, impact, and mitigation plans (Correct answer)
- Employee performance issues
- Equipment maintenance schedules
Correct answer: Identified risks, their likelihood, impact, and mitigation plans
A risk register is a formal record of identified risks along with their assessed likelihood, potential impact, owners, and planned mitigation or response actions.
Question 2: Which risk response strategy involves shifting the financial impact of a risk to a third party?
- Avoidance
- Acceptance
- Transfer (Correct answer)
- Mitigation
Correct answer: Transfer
Risk transfer moves the financial consequences of a risk to another party, such as through insurance policies or contractual liability clauses.
Question 3: What is 'residual risk' in the context of process risk management?
- Risk that exists before any controls are applied
- The risk remaining after mitigation controls have been implemented (Correct answer)
- Risk identified during the final audit phase
- Risk transferred to a subcontractor
Correct answer: The risk remaining after mitigation controls have been implemented
Residual risk is the level of risk that remains after controls, mitigations, or other risk responses have been applied to a raw or inherent risk.
Question 4: A process team identifies a risk but decides no action is needed because the cost of mitigation exceeds the expected loss. This is an example of:
- Risk avoidance
- Risk transfer
- Active risk acceptance (Correct answer)
- Passive risk acceptance
Correct answer: Active risk acceptance
Active risk acceptance is a deliberate, documented decision to tolerate a risk, often because mitigation costs outweigh the potential impact.
Question 5: Which quantitative technique uses repeated random sampling to model the probability distribution of process outcomes under uncertainty?
- SWOT analysis
- Monte Carlo simulation (Correct answer)
- Ishikawa diagram
- SIPOC mapping
Correct answer: Monte Carlo simulation
Monte Carlo simulation runs thousands of scenarios using random variable inputs to produce a probability distribution of possible outcomes.
Question 6: What is the purpose of a 'risk owner' assignment in a risk register?
- To eliminate the risk entirely
- To ensure one accountable person monitors and manages the specific risk (Correct answer)
- To document past risk incidents
- To assign financial budget for all risks
Correct answer: To ensure one accountable person monitors and manages the specific risk
A risk owner is the individual held accountable for monitoring a specific risk and ensuring that the agreed response plan is executed effectively.
Question 7: In a risk probability-impact matrix, a risk rated 'high probability / low impact' is typically managed how?
- Immediately escalated to executive leadership
- Accepted with monitoring, as combined exposure is moderate (Correct answer)
- Transferred to an insurer automatically
- Avoided by stopping the process entirely
Correct answer: Accepted with monitoring, as combined exposure is moderate
High-probability but low-impact risks often fall into a moderate overall exposure zone and are typically watched or accepted rather than demanding urgent escalation.
CPS Risk Management & Mitigation 2
In risk management, what does a 'risk register' primarily serve to document?