Risk Management & Mitigation Strategies Flashcards

Which framework is most commonly associated with enterprise risk management (ERM) and uses components such as risk appetite and risk culture?

Answer: COSO ERM

The COSO ERM framework provides guidance on enterprise-wide risk management, including risk culture, governance, and appetite.

A risk that is deliberately accepted because its cost to mitigate exceeds the potential loss is called:

Answer: Accepted risk

Risk acceptance (also called risk tolerance) means the organization knowingly chooses to live with the risk rather than spend resources reducing it.

In a risk heat map, which axis typically represents the likelihood of a risk occurring?

Answer: Horizontal axis (X-axis)

Convention varies, but likelihood (probability) is most commonly plotted on the X-axis and impact on the Y-axis in risk heat maps.

Which risk treatment option introduces new risks as a direct result of applying the original treatment?

Answer: Secondary risk

Secondary risks are unintended new risks created by implementing a risk response plan.

What does a qualitative risk assessment rely on primarily?

Answer: Expert judgment and descriptive scales (e.g., High/Medium/Low)

Qualitative risk assessments use subjective scoring and descriptive categories rather than precise numerical data.

The concept of 'risk appetite' is best defined as:

Answer: The amount and type of risk an organization is willing to accept in pursuit of its objectives

Risk appetite reflects senior management's and the board's willingness to take on risk while pursuing strategic goals.

When is a risk considered 'critical' in most GRC frameworks?

Answer: When it has both high likelihood and high impact

Risks scoring high on both likelihood and impact axes are rated critical and typically require immediate prioritized treatment.