Risk Control & Mitigation Strategies Flashcards
7 cards from real RIMS practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Risk Control & Mitigation Strategies flashcards as text
A supply chain risk manager diversifies suppliers across three continents to ensure business continuity. This strategy is best described as:
Answer: Separation of exposures
Separating exposures geographically ensures that a regional disruption cannot simultaneously impair all supply sources.
Which of the following best defines 'duplication' as a risk control technique?
Answer: Maintaining backup systems or assets so operations can continue after a primary loss
Duplication involves keeping spare or backup systems (e.g., a backup data center) so a single failure does not halt operations.
Under the RIMS Risk Maturity Model (RMM), an organization at the 'Risk Defined' level typically:
Answer: Has established formal risk policies and risk appetite statements
At the 'Risk Defined' level, formal policies, risk appetite, and basic ERM processes exist but are not yet fully embedded in strategy.
A chemical plant requires all workers to wear respirators when handling volatile solvents. In the hierarchy of controls, this represents:
Answer: Personal protective equipment (PPE)
PPE is the last line of defense in the hierarchy of controls, protecting the individual worker when other controls cannot fully eliminate exposure.
Which risk control method is most directly aligned with meeting regulatory compliance requirements?
Answer: Minimum control standards mandated by law
Compliance-driven controls are minimum standards set by regulators that organizations must meet, often forming the baseline of any risk control program.
A hotel chain conducts tabletop exercises simulating a fire evacuation. The primary risk control purpose of these exercises is to:
Answer: Test and improve emergency response procedures before a real event
Tabletop exercises are pre-loss activities that test emergency plans and identify gaps so response can be improved before an actual incident.
Which of the following is an example of a 'soft' risk control versus a 'hard' risk control?
Answer: Employee safety training (soft) vs. machine guarding (hard)
Soft controls rely on human behavior (training, culture, procedures) while hard controls are physical barriers or engineering safeguards that act independently of human action.