NES Risk Assessment & Management 5

Question 1

Which of the following is NOT a characteristic of an effective risk management program?

Accepted Answer

It eliminates all organizational risks

Answer

No risk management program can eliminate all risks; effective programs manage and mitigate risks to acceptable levels rather than achieving zero risk.

Question 2

A school district's risk manager discovers that a vendor providing IT services has poor cybersecurity practices. The BEST immediate response is to:

Accepted Answer

Require the vendor to meet security standards or replace them

Answer

Third-party risk should be addressed by requiring vendors to meet security standards, ensuring contractual obligations include security requirements.

Question 3

In quantitative risk assessment, 'Annual Loss Expectancy (ALE)' is calculated as:

Accepted Answer

Single Loss Expectancy × Annualized Rate of Occurrence

Answer

ALE = SLE × ARO, where Single Loss Expectancy represents the value at risk per event and Annualized Rate of Occurrence is how often the event is expected per year.

Question 4

Which of the following represents a 'leading indicator' in risk management?

Accepted Answer

Frequency of near-miss incidents reported this month

Answer

Leading indicators are predictive measures—like near-miss reports—that signal potential future problems before losses actually occur.

Question 5

A school district's audit committee requests a report on all risks that exceed the board's stated risk tolerance. This report would most likely come from the district's:

Accepted Answer

Enterprise risk management function

Answer

The enterprise risk management (ERM) function is responsible for tracking risks against the organization's risk appetite and tolerance and reporting exceptions to governance bodies.

NES Test Practice Test

NES Test Practice Test

NES Risk Assessment & Management 5