SPHR HR Risk Management 2 — Questions and Answers
Question 1: An organization's HRIS vendor announces it will no longer patch a legacy system that holds employee PII. What risk management step should HR take first?
- Migrate all data immediately to a new system
- Conduct a risk assessment to quantify exposure and prioritize remediation (Correct answer)
- Notify all employees of the potential breach
- Terminate the vendor contract with cause
Correct answer: Conduct a risk assessment to quantify exposure and prioritize remediation
A risk assessment establishes the scope of exposure and informs a prioritized, defensible remediation plan before any action is taken.
Question 2: Under the OSH Act's General Duty Clause, an employer is required to:
- Eliminate all recognized hazards regardless of feasibility
- Provide a workplace free from recognized hazards likely to cause death or serious harm (Correct answer)
- Post OSHA citations only in the HR department
- Inspect its own facilities annually and self-report findings
Correct answer: Provide a workplace free from recognized hazards likely to cause death or serious harm
The General Duty Clause requires employers to maintain a workplace free from recognized hazards that are causing or likely to cause death or serious physical harm.
Question 3: Which metric best indicates the effectiveness of an organization's return-to-work program in managing workers' compensation risk?
- Total recordable incident rate (TRIR)
- Average days away from work per claim (Correct answer)
- Experience modification rate (EMR) trend over three years
- Number of OSHA 300 log entries
Correct answer: Average days away from work per claim
Average days away from work per claim directly measures how quickly injured employees return to productivity, the core goal of a return-to-work program.
Question 4: A hospital HR director learns that nursing staff routinely skip a manual log step when administering medications because it slows care. This is best classified as:
- Strategic risk
- Operational risk stemming from a process control gap (Correct answer)
- Compliance risk requiring immediate OSHA notification
- Financial risk requiring insurance adjustment
Correct answer: Operational risk stemming from a process control gap
Workarounds to established procedures represent an operational risk because they expose the organization to harm through inadequate internal process controls.
Question 5: An employer's EPL (Employment Practices Liability) insurance policy covers which of the following?
- Workers' compensation claims for on-the-job injuries
- Claims arising from discrimination, wrongful termination, and harassment (Correct answer)
- Occupational disease claims filed under FECA
- Errors and omissions by HR staff in benefits administration
Correct answer: Claims arising from discrimination, wrongful termination, and harassment
EPL insurance specifically covers employer liability for employment-related claims such as discrimination, wrongful discharge, and harassment.
Question 6: During a risk heat map exercise, a risk is placed in the upper-right quadrant. What does this signify and what action is typically recommended?
- Low likelihood/high impact — accept and monitor
- High likelihood/high impact — prioritize for immediate mitigation (Correct answer)
- High likelihood/low impact — transfer to insurer
- Low likelihood/low impact — document and ignore
Correct answer: High likelihood/high impact — prioritize for immediate mitigation
The upper-right quadrant represents risks that are both highly likely and highly impactful, requiring immediate and active mitigation strategies.
Question 7: Which internal control best reduces the risk of payroll fraud in a mid-sized organization?
- Allowing managers to approve their own subordinates' time sheets
- Segregating duties so payroll processing, approval, and reconciliation are handled by different employees (Correct answer)
- Outsourcing payroll entirely to eliminate internal exposure
- Requiring employees to submit paper timesheets only
Correct answer: Segregating duties so payroll processing, approval, and reconciliation are handled by different employees
Segregation of duties prevents any single employee from controlling all aspects of a transaction, which is the most effective internal control against payroll fraud.
SPHR HR Risk Management 2
An organization's HRIS vendor announces it will no longer patch a legacy system that holds employee PII.
What risk management step should HR take first?