Risk Assessment & Management Flashcards

A school principal implements a new sign-in procedure to reduce unauthorized access to campus. This is an example of which type of risk control?

Answer: Preventive control

Preventive controls are implemented before an incident to reduce the likelihood or impact of a risk event occurring.

In business continuity planning, what is the 'Recovery Time Objective' (RTO)?

Answer: The maximum acceptable time to restore a system after disruption

RTO defines the target time within which a business process or system must be restored after a disruption to avoid unacceptable consequences.

Which of the following best describes a 'risk appetite' in organizational risk management?

Answer: The amount and type of risk an organization is willing to accept in pursuit of its objectives

Risk appetite is the level and type of risk an organization intentionally accepts while pursuing its strategic goals.

A risk assessment reveals that installing a new server room poses a fire risk. Installing a fire suppression system is an example of which risk response?

Answer: Risk mitigation

Risk mitigation reduces the probability or impact of a risk event by implementing controls, such as fire suppression systems.

During risk monitoring, a project team tracks 'risk triggers.' What are risk triggers?

Answer: Warning signs or conditions that indicate a risk is about to occur

Risk triggers are observable indicators or conditions that signal a risk event is imminent or has started to materialize.

A quantitative risk analysis technique that runs thousands of simulations to model the probability distribution of project outcomes is called:

Answer: Monte Carlo simulation

Monte Carlo simulation iteratively samples input variables across their probability distributions to produce a range of possible outcomes.

A CSET candidate reviews a scenario where a district accepts a risk because the cost of mitigation exceeds the potential loss. This decision is best classified as:

Answer: Informed risk acceptance

Informed risk acceptance occurs when decision-makers consciously choose to accept a risk after determining that the cost to mitigate it outweighs the potential loss.