Risk Management & Mitigation Strategies Flashcards

Which risk response strategy involves shifting the financial impact of a risk to a third party?

Answer: Transfer

Risk transfer moves the financial burden to another party, such as purchasing insurance or outsourcing a risky function.

A company decides not to enter a new market because the associated risks exceed its risk appetite. This is an example of which strategy?

Answer: Risk avoidance

Risk avoidance involves eliminating the risk entirely by choosing not to engage in the activity that creates it.

In quantitative risk analysis, what does Annualized Loss Expectancy (ALE) represent?

Answer: Expected monetary loss per year for a given risk

ALE is calculated as Single Loss Expectancy (SLE) multiplied by the Annualized Rate of Occurrence (ARO).

Which type of risk control is designed to detect and record security incidents after they occur?

Answer: Detective control

Detective controls identify and log incidents that have already happened, such as intrusion detection systems and audit logs.

A risk register is primarily used to:

Answer: Document, track, and monitor identified risks

A risk register is a centralized document that records risk details, owners, likelihood, impact, and mitigation actions for ongoing tracking.

What is the primary purpose of a Business Impact Analysis (BIA)?

Answer: Determine the financial and operational impact of disruptions to critical functions

A BIA identifies critical business processes and quantifies the potential impact of their disruption to prioritize recovery efforts.

Which term describes the risk that remains after all controls and mitigation strategies have been applied?

Answer: Residual risk

Residual risk is the level of risk that persists even after risk responses and controls have been implemented.