HR Risk Assessment & Management 2

Question 1

A software company is onboarding a new HR platform vendor. Which control helps mitigate third-party data-breach risk MOST directly?

Accepted Answer

Conducting a vendor security assessment and reviewing SOC 2 reports

Answer

SOC 2 reports and security assessments verify that a vendor has operational controls in place to protect data.

Question 2

In a risk matrix, a hazard rated 'High Likelihood / Low Impact' should typically be:

Accepted Answer

Monitored and mitigated with low-cost controls

Answer

High-likelihood/low-impact risks are good candidates for inexpensive controls or monitoring rather than full escalation.

Question 3

Which HR software configuration practice BEST reduces the risk of unauthorized payroll modifications?

Accepted Answer

Implementing dual-control approval workflows for payroll edits

Answer

Dual-control (four-eyes) approval ensures no single person can unilaterally change payroll records.

Question 4

A risk register entry shows Residual Risk remaining after controls. What does 'residual risk' mean?

Accepted Answer

Risk that remains after all planned controls are applied

Answer

Residual risk is the level of risk that persists even after mitigation controls have been implemented.

Question 5

An HR director wants to quantify the financial exposure of a potential data-loss event. Which metric should they calculate?

Accepted Answer

Annual Loss Expectancy (ALE)

Answer

ALE = Single Loss Expectancy × Annual Rate of Occurrence, giving a dollar figure for expected yearly loss.

HR - Software Practice Test