NES Risk Assessment & Management 3 — Questions and Answers
Question 1: When conducting a qualitative risk assessment, which approach is most commonly used?
- Calculating net present value of losses
- Assigning numerical probability and dollar amounts
- Rating risks using descriptive scales such as high, medium, and low (Correct answer)
- Running Monte Carlo simulations
Correct answer: Rating risks using descriptive scales such as high, medium, and low
Qualitative risk assessment uses descriptive ratings and expert judgment rather than precise numerical calculations to rank risks.
Question 2: A 'risk owner' in an organization is best described as:
- The person who caused the risk to occur
- The individual accountable for monitoring and managing a specific risk (Correct answer)
- The insurance company covering the risk
- The auditor who identified the risk
Correct answer: The individual accountable for monitoring and managing a specific risk
A risk owner is assigned accountability for overseeing and responding to a particular risk within an organization.
Question 3: Which of the following best describes 'inherent risk'?
- Risk that exists after all controls are in place
- Risk passed on from a parent organization
- Risk level before any controls or mitigations are applied (Correct answer)
- Risk identified through internal audit
Correct answer: Risk level before any controls or mitigations are applied
Inherent risk is the raw level of risk present in a situation before any preventive or mitigating controls are implemented.
Question 4: A school district experiences repeated small losses from minor student accidents. The BEST risk management response is likely:
- Purchase additional liability insurance
- Implement safety training and physical controls to reduce frequency (Correct answer)
- Accept the losses as part of normal operations indefinitely
- Outsource student supervision entirely
Correct answer: Implement safety training and physical controls to reduce frequency
Repeated minor losses indicate a systematic issue best addressed by mitigation controls that reduce the frequency and severity of incidents.
Question 5: In enterprise risk management (ERM), 'risk appetite' refers to:
- The total number of risks an organization has identified
- The maximum loss an organization can absorb before insolvency
- The amount of risk an organization is willing to accept in pursuit of its objectives (Correct answer)
- The budget allocated to risk management activities
Correct answer: The amount of risk an organization is willing to accept in pursuit of its objectives
Risk appetite defines the level and type of risk an organization is prepared to accept while striving to achieve its strategic goals.
Question 6: Which of the following scenarios represents a 'pure risk'?
- Investing in a new technology that may succeed or fail
- The possibility that a school bus may be involved in an accident (Correct answer)
- Launching a new academic program that could attract or lose students
- Hiring a new principal who may improve or worsen performance
Correct answer: The possibility that a school bus may be involved in an accident
Pure risks involve only the possibility of loss or no loss—there is no upside outcome—unlike speculative risks which have a potential gain.
Question 7: Which method of risk financing involves an organization setting aside funds internally to cover anticipated losses?
- Risk retention through self-insurance (Correct answer)
- Risk pooling with other entities
- Captive insurance arrangement
- Excess liability coverage
Correct answer: Risk retention through self-insurance
Self-insurance is a form of risk retention where the organization builds an internal reserve fund to pay for expected losses rather than purchasing external insurance.
NES Risk Assessment & Management 3
When conducting a qualitative risk assessment, which approach is most commonly used?