Risk Assessment & Management Flashcards
7 cards from real NES practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Risk Assessment & Management flashcards as text
Which of the following is NOT a characteristic of an effective risk management program?
Answer: It eliminates all organizational risks
No risk management program can eliminate all risks; effective programs manage and mitigate risks to acceptable levels rather than achieving zero risk.
A school district's risk manager discovers that a vendor providing IT services has poor cybersecurity practices. The BEST immediate response is to:
Answer: Require the vendor to meet security standards or replace them
Third-party risk should be addressed by requiring vendors to meet security standards, ensuring contractual obligations include security requirements.
In quantitative risk assessment, 'Annual Loss Expectancy (ALE)' is calculated as:
Answer: Single Loss Expectancy × Annualized Rate of Occurrence
ALE = SLE × ARO, where Single Loss Expectancy represents the value at risk per event and Annualized Rate of Occurrence is how often the event is expected per year.
Which of the following represents a 'leading indicator' in risk management?
Answer: Frequency of near-miss incidents reported this month
Leading indicators are predictive measures—like near-miss reports—that signal potential future problems before losses actually occur.
A school district's audit committee requests a report on all risks that exceed the board's stated risk tolerance. This report would most likely come from the district's:
Answer: Enterprise risk management function
The enterprise risk management (ERM) function is responsible for tracking risks against the organization's risk appetite and tolerance and reporting exceptions to governance bodies.
Which scenario demonstrates 'moral hazard' in the context of risk management?
Answer: A school purchases fire insurance and then reduces its fire prevention inspections
Moral hazard occurs when having insurance or protection reduces the incentive to take preventive actions, increasing risk-taking behavior.
A risk management framework requires that all identified risks be reassessed at least annually. The primary reason for this requirement is to:
Answer: Ensure that changes in the environment are reflected in the risk profile
Periodic reassessment ensures that new risks, changed circumstances, and the effectiveness of existing controls are captured and the risk profile remains current.