CRA Risk Identification Principles 3 — Questions and Answers
Question 1: In enterprise risk management, what distinguishes a 'pure risk' from a 'speculative risk'?
- Pure risks involve only the possibility of loss, while speculative risks involve both possible loss and gain (Correct answer)
- Pure risks are insurable while speculative risks have no financial impact
- Pure risks arise from internal operations while speculative risks are externally driven
- Speculative risks are identified through qualitative methods and pure risks through quantitative methods
Correct answer: Pure risks involve only the possibility of loss, while speculative risks involve both possible loss and gain
Pure risks present only downside outcomes (loss or no loss), whereas speculative risks carry both upside potential and downside loss, as seen in investment decisions.
Question 2: An organization operates in a highly regulated industry. Which risk identification source is MOST likely to surface emerging regulatory risks before they become compliance failures?
- Internal audit findings from the prior year
- Regulatory horizon scanning and legislative monitoring programs (Correct answer)
- Employee satisfaction surveys
- Post-incident review reports
Correct answer: Regulatory horizon scanning and legislative monitoring programs
Horizon scanning and legislative monitoring proactively track proposed regulations and enforcement trends before they become mandatory requirements.
Question 3: Which concept describes risks that are difficult to identify because they fall between established organizational silos and are owned by no single function?
- Residual risks
- Orphan risks (Correct answer)
- Latent risks
- Emerging risks
Correct answer: Orphan risks
Orphan risks are those that fall through the cracks of organizational ownership because they span multiple departments or functions with no clear accountable owner.
Question 4: A risk architect facilitates a pre-mortem session before a major system implementation. What is the PRIMARY purpose of this technique?
- To assign accountability for past project failures
- To prospectively imagine the project has failed and identify what could have caused it (Correct answer)
- To document lessons learned from a completed project
- To estimate the financial cost of project failure
Correct answer: To prospectively imagine the project has failed and identify what could have caused it
A pre-mortem asks participants to assume failure has already occurred and work backward to identify the most likely causes, surfacing overlooked risks.
Question 5: When identifying technology risks, which factor most significantly increases an organization's exposure to supply chain software risks?
- Using open-source software components in production systems
- Reliance on third-party libraries and software dependencies without ongoing vulnerability tracking (Correct answer)
- Deploying software on cloud infrastructure rather than on-premises
- Employing developers who work remotely
Correct answer: Reliance on third-party libraries and software dependencies without ongoing vulnerability tracking
Untracked third-party dependencies create hidden attack surfaces and vulnerabilities that the organization does not directly control or monitor.
Question 6: What is the primary purpose of a Risk Breakdown Structure (RBS) in the identification phase?
- To assign financial budgets to each identified risk
- To hierarchically categorize risk sources to ensure comprehensive coverage across all domains (Correct answer)
- To prioritize risks by their likelihood scores
- To define the escalation path for each risk category
Correct answer: To hierarchically categorize risk sources to ensure comprehensive coverage across all domains
An RBS organizes risks into a hierarchical framework by source category, helping ensure that no major risk domain is overlooked during identification.
Question 7: Which of the following scenarios BEST illustrates a 'strategic risk' as distinct from an operational risk?
- A server failure causing a four-hour production outage
- Competitor adoption of disruptive technology that renders the organization's core product obsolete (Correct answer)
- An employee error resulting in an incorrect customer invoice
- A fire suppression system failing inspection
Correct answer: Competitor adoption of disruptive technology that renders the organization's core product obsolete
Strategic risks threaten the viability of the organization's business model or competitive position, unlike operational risks which affect day-to-day processes.
CRA Risk Identification Principles 3
In enterprise risk management, what distinguishes a 'pure risk' from a 'speculative risk'?