RIMS Risk Assessment & Mitigation 2 — Questions and Answers
Question 1: Which risk assessment technique assigns numerical probabilities to potential outcomes and calculates an expected value for each risk?
- Qualitative risk analysis
- Quantitative risk analysis (Correct answer)
- Bow-tie analysis
- Root cause analysis
Correct answer: Quantitative risk analysis
Quantitative risk analysis uses numerical data and probability estimates to calculate expected monetary value (EMV) or other numerical risk metrics.
Question 2: A company's risk appetite statement specifies it will not accept any single risk event with a potential loss exceeding $5 million. This is best described as a:
- Risk tolerance threshold (Correct answer)
- Risk capacity limit
- Risk transfer trigger
- Risk retention level
Correct answer: Risk tolerance threshold
A risk tolerance threshold defines the specific boundary within which the organization is willing to operate, translating the broader risk appetite into a measurable limit.
Question 3: In the context of RIMS risk maturity, an organization that has documented risk processes but applies them inconsistently is operating at which maturity level?
- Ad hoc
- Initial
- Repeatable (Correct answer)
- Managed
Correct answer: Repeatable
The 'Repeatable' maturity level indicates processes are documented and defined, but application may still be inconsistent across the organization.
Question 4: Which of the following BEST describes a 'residual risk'?
- Risk that has been fully transferred to a third party
- Risk remaining after controls and treatments have been applied (Correct answer)
- Risk identified but not yet evaluated
- Risk eliminated through process redesign
Correct answer: Risk remaining after controls and treatments have been applied
Residual risk is the level of risk that remains after risk treatment measures, controls, and mitigations have been implemented.
Question 5: Monte Carlo simulation is used in risk management primarily to:
- Rank risks by severity using a 5x5 matrix
- Model the range of possible outcomes by running thousands of random scenarios (Correct answer)
- Identify root causes of past loss events
- Transfer catastrophic risks to reinsurers
Correct answer: Model the range of possible outcomes by running thousands of random scenarios
Monte Carlo simulation runs thousands of randomized iterations to produce a probability distribution of outcomes, helping quantify uncertainty in complex risk models.
Question 6: A hospital implements hand-washing protocols to reduce infection rates. This is an example of which risk mitigation strategy?
- Risk avoidance
- Risk transfer
- Risk reduction (control) (Correct answer)
- Risk acceptance
Correct answer: Risk reduction (control)
Implementing a control measure (hand-washing protocol) to reduce the likelihood or impact of an identified risk is a risk reduction strategy.
Question 7: Which tool maps cause-and-effect relationships between risk factors and is shaped like a fish skeleton?
- Fault tree analysis
- Ishikawa (fishbone) diagram (Correct answer)
- Event tree analysis
- Influence diagram
Correct answer: Ishikawa (fishbone) diagram
The Ishikawa or fishbone diagram visually maps cause-and-effect relationships to identify the root causes contributing to a specific risk or problem.
RIMS Risk Assessment & Mitigation 2
Which risk assessment technique assigns numerical probabilities to potential outcomes and calculates an expected value for each risk?