Chapter 10: Risk Mitigation Flashcards
What is the definition of “Risk Mitigation”?
- Risk mitigation involves implementing measures to reduce the likelihood and impact of identified risks.
What is “Avoidance”, in relation to risk mitigation strategies?
Give an example.
Eliminating activities or condiions that expose the organisation to risk e.g. Avoiding high risk investments
What is “Reduction”, in relation to risk mitigation strategies?
Give an example.
Implementing controls to reduce the liklehood or impact of risk e.g. enhancing cybersecurity measures
What is “Sharing”, in relation to risk mitigation strategies?
Give an example.
Transferring or sharing risk with other parties e.g. bying an insurance contract.
What is “Acceptance”, in relation to risk mitigation strategies?
Give an example.
Acknowledging the risk and chosing to go ahead without preventative measures e.g. putting aside recovery funds
What is the aim of a “Preventative Control”?
Give and example.
Aims to reduce the likelihood of an event happening.
e.g. Car seat belts, segregation of duties
What is the aim of “Detective Control”?
Give an example.
Aims to detect events during, or just after they occur.
e.g. Smoke alarms or file reconcilliation.
What is the purpose of “Directive Controls”?
What do they cover?
Directive controls cover all the required actions and rules to execute a process: policies and procedures, training and guidance, governance structure, roles and responsibilities
What is the aim of “Corrective Controls”?
Give an example.
Aims to mitigate the impact after an event.
e.g. Redundancies, backups, crisis communication strategies
What are the 4 forms of Control Testing?
When are each of these procedures typically used?
- Self-certification/inquiry: Interview with control owner; used for low-risk or secondary controls due to limited evidence.
- Examination: Review of documentation; offers moderate assurance, ideal for automated controls.
- Observation: Real-time oversight of control execution; assesses design and effectiveness of key controls.
- Reperformance: Replicates control processes on sample transactions; provides highest assurance, recommended for high-risk environments.
What are “Optimistic Controls”?
What does these rely on? Give an example.
Rely on exceptional ability or motivation, often becoming superficial “tick-box” tasks.
e.g. Lat minute sign offs on large document volumes.
What are “Duplicative Controls”?
Known as the “Four……….”, what can this lead to?
Commonly known as the “four eyes” check, where more than one person review the same information. This dilutes accountability, reducing focus. Works most effectively when involving people from different roles/functions.
What is meant by “more of the same” in respect of controls?
What can this do?
Adding more controls of the same design after a failure, which can often worsen the issue.
What is meant by a “slip” in realtion to human error?
What are some solutions?
Involuntary errors due to distraction, inattention, or poor work envirnments
improving workspaces, reducing noise, and clarifying responsibilities.
What are the 2 forms of “Mistake”?
- Rule-based Mistakes: Caused by flawed or conflicting rules
- Knowledge-based Mistakes: Results from unfarmiliartity or lack of training.
What is a “Violation”?
How are these mitigated, FOS?
Deliberate disregard for rules. Mitigated by supervision and strong organisational culture.
Conceptually, what is Human Error a symptom of?
What causes it?
Problems with proceses, not personal incompetence.
What are the benefits of “effective risk mitigation”?
5 points
- Reduced Risk Exposure
- Enhanced Resilience
- Regulatory Compliance
- Increased Stakeholder Confidence
- Operational Continuity
What are some methods for “Prevention by Design”?
5 points
- Process Redesign: Improve reliability of actions.
- Checklists: Ensure all steps are followed.
- Strong Communication Protocols: Facilitate clear andconsistent communication.
- Standardization: Uniform procedures to reduce variability.
- Better Work Environments: Enhance overall operational efficiency
What are the 2 main considerations when transferring risk?
What cannot be outsourced?
- Cost vs Risk Reduction
- Reputation risk cannot be outsourced
