MR Risk Assessment and Management 3 — Questions and Answers
Question 1: In a risk heat map, what do the axes typically represent?
- Cost and timeline
- Likelihood and impact (Correct answer)
- Severity and frequency
- Threat source and asset value
Correct answer: Likelihood and impact
A risk heat map plots risks on a matrix with likelihood (probability) on one axis and impact (consequence) on the other to prioritize treatment.
Question 2: Which clause of ISO 9001:2015 specifically addresses actions to address risks and opportunities?
- Clause 4
- Clause 5
- Clause 6 (Correct answer)
- Clause 8
Correct answer: Clause 6
ISO 9001:2015 Clause 6 (Planning) requires organizations to determine risks and opportunities and plan actions to address them.
Question 3: What is the purpose of a risk appetite statement in an organization?
- To list all identified risks in priority order
- To define how much risk the organization is willing to accept in pursuit of its objectives (Correct answer)
- To specify the budget allocated for risk management activities
- To document the history of past risk incidents
Correct answer: To define how much risk the organization is willing to accept in pursuit of its objectives
A risk appetite statement communicates the level and type of risk an organization is willing to take to achieve its strategic objectives.
Question 4: A 'bowtie' risk analysis diagram visually represents:
- The organizational hierarchy for risk reporting
- Causes leading to a hazard event and the consequences flowing from it (Correct answer)
- The cost-benefit ratio of different control options
- The timeline of risk mitigation activities
Correct answer: Causes leading to a hazard event and the consequences flowing from it
A bowtie diagram maps threat causes (left side) through a central hazard event and shows the consequences (right side), with controls on both sides.
Question 5: In risk management, 'inherent risk' refers to:
- Risk that has been fully mitigated
- Risk that exists before any controls are applied (Correct answer)
- Risk transferred through insurance
- Risk accepted by senior management
Correct answer: Risk that exists before any controls are applied
Inherent risk is the level of risk in a process or activity before any controls or mitigating actions have been put in place.
Question 6: Which of the following is a leading indicator in risk management?
- Number of incidents recorded last quarter
- Near-miss reports submitted this month (Correct answer)
- Total cost of claims paid out
- Audit findings from the previous year
Correct answer: Near-miss reports submitted this month
Near-miss reports are leading indicators because they signal potential future failures before they result in an actual incident.
Question 7: What is the primary function of a risk register?
- To record financial losses from past risk events
- To document identified risks, their assessments, and treatment plans (Correct answer)
- To assign insurance coverage to specific risks
- To communicate risks to external stakeholders only
Correct answer: To document identified risks, their assessments, and treatment plans
A risk register is a central document that captures identified risks, their likelihood and impact ratings, owners, and the treatment or mitigation actions planned or taken.
MR Risk Assessment and Management 3
In a risk heat map, what do the axes typically represent?