Risk Assessment & Mitigation Flashcards
7 cards from real RIMS practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Risk Assessment & Mitigation flashcards as text
A risk register entry lists inherent risk as 'High' and residual risk as 'Low' after controls. If controls fail, the risk reverts to:
Answer: Inherent risk level
Inherent risk is the level of risk before any controls or treatments are applied; if controls fail or are removed, the risk exposure returns to its inherent level.
Which qualitative risk assessment method gathers expert opinions anonymously through multiple rounds of questionnaires to build consensus?
Answer: Delphi technique
The Delphi technique uses iterative, anonymous questionnaires among experts to converge on a consensus risk assessment, minimizing groupthink and dominant-voice bias.
Under ISO 31000:2018, the risk management process begins with which step?
Answer: Establishing context and scope
ISO 31000 requires first establishing the internal and external context, scope, criteria, and stakeholder relationships before identifying or evaluating risks.
A company acquires cyber liability insurance with a $1 million deductible. The $1 million retained portion represents:
Answer: Pure risk retention
The deductible amount the insured retains financially is a form of pure risk retention — the organization bears that portion of loss from its own funds.
Which of the following BEST describes the purpose of a risk control self-assessment (RCSA)?
Answer: Enabling business units to assess their own risks and control effectiveness
RCSA is a participatory process where business units evaluate the risks they face and the effectiveness of their controls, promoting risk ownership at the operational level.
What is 'correlation risk' in the context of a diversified risk portfolio?
Answer: The risk that assets or losses move together during stress events, reducing diversification benefits
Correlation risk occurs when risks that appear uncorrelated under normal conditions become correlated during stress events, undermining the protective value of diversification.
A risk manager presents a 'risk appetite statement' to the board. The PRIMARY purpose of this document is to:
Answer: Define the types and levels of risk the organization is willing to accept in pursuit of its strategy
A risk appetite statement articulates the amount and type of risk an organization is willing to accept while pursuing its strategic objectives, guiding risk decision-making at all levels.