5 - Tools and techniques 2: Assessment and measurement of risk Flashcards
If all claims payments must be authorised by the claims manager before being paid, this is an example of what type of risk control?
Preventive
When designing a risk register, what way must info be stored?
information must be stored in a way that is easy to extend and change.
Is a small charity which relies on local publicity for its fundraising exposed to the risk of closure in the event of damage to its reputation?
Yes
A haulage firm has identified an accident rate of 10 per 500 drivers employed per year. Assuming unchanged circumstances, what is the probability of a driver having an accident in the coming year?
0.02.
A property rental firm lets out a mill building to a variety of tenants. The building has four floors and is fitted with a sprinkler system throughout. What is the maximum possible loss as a result of fire?
100%.
As part of a risk assessment process, an engineering firm has identified the risks faced by the organisation. When categorising these risks, typically the MOST suitable method is by:
events
What is the MAIN benefit to an organisation of allocating risks to numerical bandings of probability and impact?
Risks can be compared internally in an objective and consistent manner.
What type of risk is NOT covered by the Basel II banking regulations?
Reputational risk.
The exposure of an organisation to a particular risk is measured through a combination of:
impact and probability.
The process of comparing different risks and presenting them in an order of priority for the use of resources is typically known as risk:
ranking
Often there is a time delay between cause and effect of a risk. How does this timescale help us with risk classification?
Risks with long timescales (years) are generally related to strategy, having the
potential to undermine fulfilment of strategic: objectives. Medium-term risks (months) are generally associated with projects, processes, change programmes, acquisitions and the like. Risks with immediate potential to disrupt current operations are clearly operational risks. Long-term risks may relate to opportunity as well as threat.
Checklists, worksheets and test schedules are widely used directive controls. Why are they so important?
They are designed to ensure all critical aspects of a task have been properly addressed and completed. Such instructions are particularly important in assembly, maintenance, testing and repairs of components of systems where utmost reliability is essential, e.g. aviation, aerospace, nuclear power, oil and gas exploration.
Why are risk categorization systems important?
Risk categorization systems are important because they allow an organisation to consider where similar risks may lie: within and outside its operations. It will also clarify potential for applying generic risk control strategies across similar risks.
List the four types of risk that might threaten business survival.
• High monetary value incidences of common risks such as physical damage, fraud or misuse of funds.
• Loss of confidence.
• Credit, solvency and liquidity risks.
• Third party damage.
Risk appetite can be reflected in a probability/impact matrix by introducing a tolerance line. What purpose does it serve?
The purpose of a tolerance line is to separate those risks which are acceptable and need no action from those that are not acceptable and require attention.
What are the four main types of risk control?
Risk controls can be classified as preventive, corrective, directive and detective.
What information does a risk register contain?
A risk register contains various information which an organisation needs to manage risks.
Why are financial risk models commonly used for stress testing?
Financial risk models are used because concepts such as profit, solvency and liquidity are mathematically related to sales, costs, liabilities and asset values, so stress tests can explore the effect of variations in individual parameters.
What is the objective of producing risk reports?
The objective of risk reports is to provide accurate and concise information in a format that the recipient can understand.
It is only when we understand all possible consequences of an incident that we can decide how to manage the …
underlying risk.
