MR Risk Assessment and Management 2 — Questions and Answers
Question 1: Which risk treatment option involves sharing the financial consequences of a risk with a third party, such as through insurance?
- Risk avoidance
- Risk transfer (Correct answer)
- Risk acceptance
- Risk reduction
Correct answer: Risk transfer
Risk transfer shifts the financial burden of a risk to another party, commonly achieved through insurance or contractual agreements.
Question 2: In ISO 31000, what is the term for the combination of the probability of an event and its consequence?
- Hazard level
- Risk (Correct answer)
- Threat vector
- Impact score
Correct answer: Risk
ISO 31000 defines risk as the effect of uncertainty on objectives, often expressed as a combination of probability and consequence.
Question 3: A risk owner is primarily responsible for:
- Identifying all organizational risks
- Approving the risk management budget
- Ensuring appropriate controls are implemented for assigned risks (Correct answer)
- Auditing the risk register annually
Correct answer: Ensuring appropriate controls are implemented for assigned risks
A risk owner is accountable for ensuring that appropriate risk controls and treatment measures are implemented and maintained for their assigned risks.
Question 4: What does FMEA stand for in the context of risk analysis?
- Failure Mode and Effects Analysis (Correct answer)
- Functional Management and Error Assessment
- Frequency Monitoring and Escalation Analysis
- Fault Mode and Event Audit
Correct answer: Failure Mode and Effects Analysis
FMEA (Failure Mode and Effects Analysis) is a systematic technique for identifying potential failures in a product or process and analyzing their effects.
Question 5: Which of the following best describes 'residual risk'?
- Risk identified but not yet assessed
- Risk remaining after controls have been applied (Correct answer)
- Risk transferred to a third party
- Risk with a probability of zero
Correct answer: Risk remaining after controls have been applied
Residual risk is the level of risk that remains after risk treatment or control measures have been implemented.
Question 6: When conducting a business impact analysis (BIA), the primary goal is to:
- Rank suppliers by delivery performance
- Identify critical processes and the impact of their disruption (Correct answer)
- Calculate return on investment for control measures
- Document all employee roles and responsibilities
Correct answer: Identify critical processes and the impact of their disruption
A BIA identifies which business processes are critical and quantifies the potential impact if those processes are disrupted.
Question 7: Which risk assessment approach uses historical data, statistical models, and numerical values to express risk levels?
- Qualitative risk assessment
- Quantitative risk assessment (Correct answer)
- Semi-quantitative risk assessment
- Descriptive risk assessment
Correct answer: Quantitative risk assessment
Quantitative risk assessment relies on numerical data and statistical modeling to calculate precise risk values such as Annual Loss Expectancy (ALE).
MR Risk Assessment and Management 2
Which risk treatment option involves sharing the financial consequences of a risk with a third party, such as through insurance?