Risk Mitigation Strategies & Controls Flashcards

A risk architect is reviewing a vendor contract that includes an indemnification clause requiring the vendor to cover losses from their service failures. This is an example of:

Answer: Contractual risk transfer

An indemnification clause contractually shifts financial liability for the vendor's failures to the vendor, constituting a risk transfer mechanism.

Which of the following represents a key weakness in relying solely on insurance as a risk mitigation strategy?

Answer: Insurance does not cover all types of losses and may not compensate for reputational damage

Insurance can offset direct financial losses but cannot fully compensate for reputational harm, regulatory penalties, or operational disruptions from risk events.

When applying a risk mitigation hierarchy, which approach should typically be considered first before other response strategies?

Answer: Risk elimination (avoidance)

Risk elimination — removing the source of the risk entirely — is the most effective response and should be evaluated before less complete strategies.

A control testing program finds that 30% of sampled transactions lack required manager approvals. This finding represents:

Answer: A control operating effectiveness deficiency

When a control is properly designed but not consistently followed in practice, the issue is an operating effectiveness deficiency rather than a design flaw.

In enterprise risk management, what is the primary purpose of a Key Risk Indicator (KRI)?

Answer: To provide early warning signals that a risk is increasing toward an unacceptable level

KRIs are forward-looking metrics that signal when risk levels are trending toward or exceeding established thresholds, enabling proactive management.

Which scenario best illustrates the concept of 'risk appetite' influencing mitigation strategy selection?

Answer: An aggressive fintech accepting higher cyber risk than peers to accelerate product launches

An aggressive fintech consciously accepting higher-than-average cyber risk reflects a high risk appetite driving strategic decisions about which risks to accept versus mitigate.

A risk architect recommends that third-party vendors undergo annual security assessments as part of the enterprise risk program. This is primarily designed to address which risk category?

Answer: Third-party and supply chain risk

Annual vendor security assessments are a key control for third-party risk, ensuring that vendors' security postures do not introduce unacceptable risk to the enterprise.