CRA Risk Mitigation Strategies & Decision-Making 3 — Questions and Answers
Question 1: A utility company uses scenario analysis to evaluate outcomes under a 'severe drought' scenario. The PRIMARY distinction between scenario analysis and sensitivity analysis is:
- Scenario analysis changes one variable at a time; sensitivity analysis changes many
- Scenario analysis evaluates coherent combinations of variables; sensitivity analysis isolates individual variables (Correct answer)
- Sensitivity analysis uses Monte Carlo; scenario analysis uses regression
- Scenario analysis is qualitative only; sensitivity analysis is always quantitative
Correct answer: Scenario analysis evaluates coherent combinations of variables; sensitivity analysis isolates individual variables
Scenario analysis constructs internally consistent narratives where multiple variables shift together, whereas sensitivity analysis isolates the impact of changing one variable while holding others constant.
Question 2: A risk manager must choose between two loss-control options: Option A reduces frequency by 40%; Option B reduces severity by 40%. With many high-frequency, low-severity events, which option generally provides more value?
- Option B, because severity drives total losses more
- Option A, because reducing many small events lowers total expected loss more efficiently (Correct answer)
- Both options always provide equal value
- Option B, because insurance prices are based on severity only
Correct answer: Option A, because reducing many small events lowers total expected loss more efficiently
When losses are high-frequency and low-severity, reducing frequency cuts the large number of events and typically lowers aggregate expected loss more than reducing individual event size.
Question 3: In a risk matrix, a threat assessed as 'high likelihood, low impact' should PRIMARILY be addressed with:
- Risk avoidance, to eliminate the frequent threat entirely
- Risk reduction controls, to lower the frequency of occurrence (Correct answer)
- Risk transfer via insurance, since impact is unpredictable
- Acceptance with monitoring, as low impact makes it manageable
Correct answer: Risk reduction controls, to lower the frequency of occurrence
High-frequency, low-impact risks are prime candidates for reduction controls that address root causes, lowering the rate of occurrence to an acceptable level.
Question 4: When applying the precautionary principle in risk decision-making, an organization should:
- Wait for complete scientific certainty before acting on potential threats
- Take preventive action even when full causal evidence is lacking, if consequences could be severe (Correct answer)
- Transfer all uncertain risks to third parties immediately
- Accept uncertain risks as part of normal business operations
Correct answer: Take preventive action even when full causal evidence is lacking, if consequences could be severe
The precautionary principle mandates protective action under uncertainty when potential harm is serious or irreversible, even without conclusive scientific proof.
Question 5: A chief risk officer presents a risk report to the board showing that 80% of the firm's VaR comes from 3 of 50 risk factors. This finding BEST supports a decision to:
- Diversify the portfolio to spread risk evenly across all 50 factors
- Concentrate mitigation resources on the dominant 3 risk factors (Correct answer)
- Transfer all 50 risk factors to insurance carriers
- Eliminate the 3 risk factors by exiting associated business lines
Correct answer: Concentrate mitigation resources on the dominant 3 risk factors
Pareto analysis reveals that a small number of risk factors drive most exposure, directing limited mitigation resources to where they will have the greatest impact.
Question 6: A company enters a joint venture specifically to share the capital cost and risk of entering a new market. This is an example of:
- Risk avoidance
- Risk retention
- Risk transfer
- Risk sharing (Correct answer)
Correct answer: Risk sharing
Risk sharing distributes exposure among multiple parties, as in a joint venture where each partner bears a proportional share of the potential loss and gain.
Question 7: The 'bow-tie' model in risk management visually connects:
- Residual risk to inherent risk across multiple periods
- Threats and prevention controls on the left with consequences and recovery controls on the right (Correct answer)
- Qualitative risk scores to quantitative loss distributions
- Risk appetite to risk tolerance thresholds
Correct answer: Threats and prevention controls on the left with consequences and recovery controls on the right
The bow-tie diagram places the hazard event in the center, with threat causes and prevention barriers on the left side and consequence outcomes with recovery controls on the right.
CRA Risk Mitigation Strategies & Decision-Making 3
A utility company uses scenario analysis to evaluate outcomes under a 'severe drought' scenario.
The PRIMARY distinction between scenario analysis and sensitivity analysis is: