Risk Assessment & Management Flashcards

A safety officer conducts a Failure Mode and Effects Analysis (FMEA). What is the primary output of this analysis?

Answer: A ranking of failure modes by their Risk Priority Number (RPN)

FMEA produces Risk Priority Numbers (RPN) by multiplying severity, occurrence, and detectability ratings to rank failure modes.

Which risk management framework, widely used in IT and organizational settings, categorizes controls as preventive, detective, and corrective?

Answer: NIST Cybersecurity Framework

The NIST Cybersecurity Framework organizes security controls into categories including preventive, detective, and corrective control types.

A project team identifies a risk and decides to monitor it without taking immediate action because the potential impact is very low. This approach is called:

Answer: Passive risk acceptance

Passive risk acceptance means acknowledging a risk and choosing not to act unless it materializes, typically because it has low impact.

In a risk assessment, a 'threat agent' is best defined as:

Answer: The entity or force that can exploit a vulnerability

A threat agent is the actor—human, natural, or technical—capable of intentionally or unintentionally exploiting a vulnerability.

A district technology coordinator uses a decision tree to evaluate two possible responses to a cybersecurity risk. What does a decision tree primarily help with in risk management?

Answer: Visually mapping outcomes and expected values of different decisions

A decision tree maps possible choices and their probabilistic outcomes, allowing comparison of expected values to support decision-making.

What distinguishes 'secondary risks' from 'residual risks' in project risk management?

Answer: Secondary risks arise as a direct result of implementing a risk response; residual risks remain after responses are applied

Secondary risks are new risks created by the act of implementing a risk response, while residual risks are those that remain despite mitigation.

According to ISO 31000, which step immediately follows 'risk identification' in the risk assessment process?

Answer: Risk analysis

ISO 31000 defines risk assessment as comprising risk identification, risk analysis, and risk evaluation in that sequence.