NES Risk Assessment & Management 5 — Questions and Answers
Question 1: Which of the following is NOT a characteristic of an effective risk management program?
- It is integrated into strategic planning
- It eliminates all organizational risks (Correct answer)
- It involves communication across all levels of the organization
- It is regularly reviewed and updated
Correct answer: It eliminates all organizational risks
No risk management program can eliminate all risks; effective programs manage and mitigate risks to acceptable levels rather than achieving zero risk.
Question 2: A school district's risk manager discovers that a vendor providing IT services has poor cybersecurity practices. The BEST immediate response is to:
- Accept the risk because the vendor is already contracted
- Require the vendor to meet security standards or replace them (Correct answer)
- Purchase cyber liability insurance for the district
- Transfer all district data to an in-house server
Correct answer: Require the vendor to meet security standards or replace them
Third-party risk should be addressed by requiring vendors to meet security standards, ensuring contractual obligations include security requirements.
Question 3: In quantitative risk assessment, 'Annual Loss Expectancy (ALE)' is calculated as:
- Total assets × probability of total loss
- Single Loss Expectancy × Annualized Rate of Occurrence (Correct answer)
- Budget allocated to risk controls ÷ number of risks
- Maximum possible loss × risk tolerance percentage
Correct answer: Single Loss Expectancy × Annualized Rate of Occurrence
ALE = SLE × ARO, where Single Loss Expectancy represents the value at risk per event and Annualized Rate of Occurrence is how often the event is expected per year.
Question 4: Which of the following represents a 'leading indicator' in risk management?
- Number of insurance claims filed last year
- Frequency of near-miss incidents reported this month (Correct answer)
- Total losses incurred in the previous fiscal year
- Average recovery time after past incidents
Correct answer: Frequency of near-miss incidents reported this month
Leading indicators are predictive measures—like near-miss reports—that signal potential future problems before losses actually occur.
Question 5: A school district's audit committee requests a report on all risks that exceed the board's stated risk tolerance. This report would most likely come from the district's:
- Legal counsel
- Public information officer
- Enterprise risk management function (Correct answer)
- Facilities management department
Correct answer: Enterprise risk management function
The enterprise risk management (ERM) function is responsible for tracking risks against the organization's risk appetite and tolerance and reporting exceptions to governance bodies.
Question 6: Which scenario demonstrates 'moral hazard' in the context of risk management?
- A school purchases fire insurance and then reduces its fire prevention inspections (Correct answer)
- A district buys additional liability coverage after a lawsuit
- A safety officer recommends stricter building codes following an inspection
- A vendor requires indemnification clauses in service contracts
Correct answer: A school purchases fire insurance and then reduces its fire prevention inspections
Moral hazard occurs when having insurance or protection reduces the incentive to take preventive actions, increasing risk-taking behavior.
Question 7: A risk management framework requires that all identified risks be reassessed at least annually. The primary reason for this requirement is to:
- Satisfy external auditors and regulatory agencies
- Ensure that changes in the environment are reflected in the risk profile (Correct answer)
- Reduce the workload of the risk manager by standardizing reviews
- Document that risks have been formally acknowledged by leadership
Correct answer: Ensure that changes in the environment are reflected in the risk profile
Periodic reassessment ensures that new risks, changed circumstances, and the effectiveness of existing controls are captured and the risk profile remains current.
NES Risk Assessment & Management 5
Which of the following is NOT a characteristic of an effective risk management program?