Risk Identification Principles Flashcards

What is the key distinction between 'inherent risk' and 'residual risk' in the risk identification and assessment process?

Answer: Inherent risk exists before any controls are applied; residual risk remains after controls are in place

Inherent risk is the raw exposure level without controls, while residual risk reflects the exposure that persists after existing controls are factored in.

A risk architect is asked to identify risks associated with a new AI-driven decision-making system. Which risk is MOST unique to AI systems compared to traditional software?

Answer: Model drift leading to biased or degraded decisions over time without detection

Model drift is a distinctive AI risk where the model's accuracy degrades as real-world data patterns shift away from training data, often without obvious external indicators.

Which of the following BEST describes the purpose of a 'risk universe' in enterprise risk management?

Answer: A comprehensive inventory of all risk types the organization could potentially face across all domains

A risk universe provides a complete catalog of potential risk categories, ensuring risk identification efforts are exhaustive and systematic rather than reactive.

During a risk identification workshop, a participant suggests that a new product launch carries reputational risk. What additional step is MOST important to properly capture this risk?

Answer: Define the specific scenarios and causal pathways through which reputational damage could occur

Reputational risk must be grounded in specific, concrete scenarios to be actionable; a vague label without causal pathways cannot be assessed or mitigated effectively.

What is the primary limitation of using ONLY historical loss data for risk identification?

Answer: It cannot identify risks that have not yet manifested in losses, including novel and emerging risks

Historical loss data is inherently backward-looking and cannot surface risks with no prior loss history, such as emerging threats or unprecedented scenarios.

A CRA is designing a risk identification process for a multinational organization. Which consideration is MOST critical when identifying risks across different geographic regions?

Answer: Accounting for differing legal, political, cultural, and macroeconomic risk factors in each jurisdiction

Multinational risk identification must account for jurisdiction-specific factors such as local regulations, political stability, currency risk, and cultural attitudes toward risk disclosure.

In risk identification, what does the PESTLE framework help an organization systematically analyze?

Answer: Political, Economic, Social, Technological, Legal, and Environmental macro-level risk factors

PESTLE is a structured environmental scanning tool that identifies macro-level external risks across six categories: Political, Economic, Social, Technological, Legal, and Environmental.