Risk Assessment & Management Flashcards

A school district identifies that a new software system could fail during high-stakes testing. Which risk response strategy involves purchasing cybersecurity insurance to cover potential losses?

Answer: Risk transfer

Risk transfer shifts the financial consequences of a risk to a third party, such as an insurance provider.

During a quantitative risk analysis, a project manager calculates Expected Monetary Value (EMV). If an event has a 30% probability of occurring and would cost $50,000, what is its EMV?

Answer: $15,000

EMV is calculated by multiplying the probability (0.30) by the impact ($50,000), yielding $15,000.

Which risk analysis technique uses optimistic, pessimistic, and most likely estimates to model uncertainty in project timelines?

Answer: PERT analysis

PERT (Program Evaluation and Review Technique) uses three-point estimates to calculate expected durations under uncertainty.

A risk register entry shows a risk with HIGH likelihood and LOW impact. How should this risk be prioritized compared to a risk with LOW likelihood and HIGH impact?

Answer: Prioritization depends on the calculated risk score for each

Risk prioritization is based on the overall risk score (likelihood × impact), not on either factor alone.

In the context of information security risk management, what does the term 'vulnerability' refer to?

Answer: A weakness that can be exploited by a threat

A vulnerability is a weakness or gap in a system's defenses that a threat can exploit to cause harm.

A project team decides to eliminate a high-risk activity from the project scope entirely. Which risk response strategy are they using?

Answer: Risk avoidance

Risk avoidance eliminates the risk entirely by removing the activity or changing the plan so the risk cannot occur.

Which component of a comprehensive risk management plan describes the roles and responsibilities of team members in identifying and managing risks?

Answer: Risk management roles matrix

A risk management roles matrix (or RACI chart) clarifies who is responsible, accountable, consulted, and informed for each risk management activity.