Risk Assessment and Identification Techniques Flashcards
7 cards from real GRC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Risk Assessment and Identification Techniques flashcards as text
Which risk identification method involves structured interviews and workshops with business stakeholders to surface risks from those closest to the processes?
Answer: Facilitated risk workshops and interviews
Facilitated workshops and interviews engage process owners and subject-matter experts directly, leveraging their knowledge to identify risks that may not be visible from data alone.
A Control Self-Assessment (CSA) is a technique where:
Answer: Management and staff assess the effectiveness of controls over their own processes
CSA empowers process owners and their teams to evaluate control effectiveness themselves, promoting accountability and surfacing risk insights without waiting for formal audits.
When assessing risk likelihood (probability), which scale is commonly used in qualitative risk assessment?
Answer: Ordinal scales such as Rare / Unlikely / Possible / Likely / Almost Certain
Qualitative likelihood assessments use descriptive ordinal scales to categorize how frequently a risk event might occur, without requiring precise statistical probabilities.
What is the primary purpose of a risk appetite statement in an organization?
Answer: To communicate the amount and type of risk the board and senior management are willing to accept in pursuit of objectives
A risk appetite statement formally articulates the board-approved boundaries of acceptable risk-taking, guiding strategic decisions and operational risk management.
Which concept describes the process of systematically identifying potential risks by examining all assets, threats, and vulnerabilities in a structured manner?
Answer: Risk identification
Risk identification is the process of finding, recognizing, and describing risks before they can be analyzed or treated, forming the first step of the risk management cycle.
In risk prioritization, which combination of factors typically determines a risk's priority for treatment?
Answer: Likelihood of occurrence and magnitude of potential impact
Risks are prioritized based on their likelihood (how probable) and impact (how severe), with high-likelihood/high-impact risks receiving the greatest attention and resources.
SWOT analysis contributes to risk identification by helping an organization:
Answer: Identify internal Strengths and Weaknesses alongside external Opportunities and Threats
SWOT analysis surfaces risks by exposing internal weaknesses that could be exploited and external threats that could harm the organization, while also identifying positive risk opportunities.