Risk Assessment & Mitigation Flashcards
7 cards from real RIMS practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Risk Assessment & Mitigation flashcards as text
When conducting a Business Impact Analysis (BIA), which metric represents the maximum time a business process can be disrupted before causing unacceptable harm?
Answer: Maximum Tolerable Downtime (MTD)
Maximum Tolerable Downtime (MTD) defines the longest period a business function can be unavailable before the organization suffers irreversible consequences.
A risk manager uses scenario analysis to evaluate the impact of a major cyberattack on operations. What is the PRIMARY purpose of this technique?
Answer: To understand potential outcomes and test response readiness
Scenario analysis explores hypothetical 'what-if' situations to understand potential impacts and prepare response strategies, improving organizational resilience.
Which of the following is a characteristic of 'black swan' events that makes them challenging for traditional risk models?
Answer: They are rare, unpredictable, and have extreme consequences
Black swan events are statistically rare, lie outside normal expectations, and carry massive impact — making them very difficult for conventional probability-based models to anticipate.
A risk heat map that shows many risks clustered in the high-likelihood/high-impact quadrant signals that the organization should:
Answer: Prioritize immediate treatment actions and escalate to senior leadership
Risks in the high-likelihood/high-impact quadrant require urgent treatment and executive attention because they pose the greatest threat to organizational objectives.
In ERM, a 'risk owner' is defined as:
Answer: The individual accountable for managing a specific risk and implementing controls
A risk owner is the designated individual with the authority and accountability to manage, monitor, and report on a specific risk within the risk register.
Which risk treatment option is MOST appropriate when the cost of controlling a risk exceeds the potential loss from the risk itself?
Answer: Risk acceptance (retention)
When control costs exceed potential losses, risk acceptance (retention) is economically rational — the organization consciously decides to absorb the risk rather than overspend on mitigation.
A supply chain risk assessment reveals a single-source supplier for a critical component. The BEST mitigation strategy is to:
Answer: Qualify alternative suppliers to reduce single-source dependency
Qualifying alternative suppliers directly addresses the single-source concentration risk by building redundancy and reducing dependency on one vendor.