CRA Risk Identification Principles 2

Question 1

Which risk identification technique involves systematically examining each component of a system to determine how it could fail and the consequences of that failure?

Accepted Answer

Failure Mode and Effects Analysis (FMEA)

Answer

Fault Tree Analysis

Answer

Delphi Technique

Answer

Root Cause Analysis

Question 2

In risk identification, what does the term 'velocity' refer to?

Accepted Answer

The speed at which a risk can impact the organization after it materializes

Answer

The frequency with which a risk event repeats

Answer

The rate at which risk exposure grows over time

Answer

The speed of implementing risk controls

Question 3

A risk architect is reviewing an organization's supply chain. Which approach best identifies risks that span multiple vendors and interdependencies?

Accepted Answer

End-to-end process mapping with cross-vendor dependency identification

Answer

Individual vendor risk assessments conducted independently

Answer

Bow-tie analysis focused on a single critical vendor

Answer

A checklist review of contractual obligations

Question 4

Which of the following best describes a 'risk trigger' in the identification process?

Accepted Answer

An early warning indicator that signals a risk event may be imminent

Answer

A threshold at which a risk is escalated to senior management

Answer

The monetary value at which a risk requires insurance

Answer

A control mechanism that prevents risk occurrence

Question 5

When using structured interviews for risk identification, what is the PRIMARY advantage over group workshops?

Accepted Answer

Interviews allow individuals to express concerns without group influence or anchoring bias

Answer

Structured interviews are less time-consuming than workshops

Answer

Interviews produce more quantitative risk data than workshops

Answer

Structured interviews eliminate the need for a facilitator

Question 6

A CRA candidate reviews an organization's risk register and finds many risks are described as 'compliance failure' or 'cyber breach.' What is the main problem with these descriptions?

Accepted Answer

They lack root cause context and confuse risk events with risk categories

Answer

They are too specific and limit the scope of risk monitoring

Answer

They are appropriate for a high-level risk register

Answer

They should only appear in operational risk registers, not enterprise ones

Question 7

Which risk identification tool uses a visual representation of causal relationships between a central risk event, its causes, and its consequences simultaneously?

Accepted Answer

Bow-tie analysis

Answer

Influence diagram

Answer

Ishikawa diagram

Answer

Risk breakdown structure