Domain II - Principles of Risk Management Processes Flashcards
1. A ministry of health wants to assess its ability to respond to an outbreak of cholera. The ministry assesses the inherent risks associated with cholera and with different scenarios under which an epidemic might unfold, such as an earthquake or a severe weather event. Which risk criteria best describe the ministry’s expanded “terms of reference against which the significance of risk is evaluated?” I. Volatility. II. Correlation. III. Velocity. IV. Interdependency. a. I and IV. b. II and IV. c. II and III. d. III and IV
Solution: c (II and III)
I. Incorrect. Volatility refers to situations in which conditions vary greatly and therefore make it
harder to predict the likelihood of a given event. The ministry is controlling its risk variables by
accounting for different scenarios.
II. Correct. The ministry uses correlation analysis to determine both the increased impact and
likelihood of a cholera outbreak due to weather or natural disaster-related disruptions to the
food supply and emergency medical intervention.
III. Correct. The ministry’s primary objective is gauging risk velocity as it measures how much time
it will have between the trigger events and the impact or onset of cholera.
IV. Incorrect. While interdependency is similar to correlation in that it “relates to the connection of
two or more risks,” interdependency relates to the “mutual dependency of risks precipitating new
and potentially unexpected risks.” The ministry is focusing on how its ability to respond to a
cholera outbreak will vary under different geological and weather scenarios.
HAL, a leading software and hardware vendor in the private sector, is weighing the pros and cons of expanding into the public sector. Which are the most appropriate terms to describe the risks that HAL is evaluating? I. Speculative risk. II. Market risk. III. Enterprise risk. IV. Technology risk. a. I and II. b. I and III. c. II and IV. d. III and IV.
Solution: b (I and III)
I. Correct. “Risks that can be exploited for gain can be called speculative risk (or upside risk or
opportunity).”
II. Incorrect. Market risk relates to changes in the value of the stock (share price.)
III. Correct. Enterprise risk is a business risk associated with selecting and undertaking business
activities.
IV. Incorrect. Technology risks are those that new technology brings to all aspects of activity. HAL
faces technology risks regardless of whether it remains focused on the private sector or expands
to include the public sector.
The state assembly decrees that the state’s Pension Investment Division (PID) must divest of
all holdings related to a certain country. Soon after, the financial markets soar on unexpected
predictions of a dramatic economic recovery. In response, PID sells large positions of its
portfolio at a premium and covers its losses from the mandated divestiture. According to the
bowtie diagram analysis methodology, what two terms best describe the risk factors leading
to the sale?
I. Consequence.
II. Trigger event.
III. Risk event.
IV. Intermediate event.
a. II and IV.
b. I and III.
c. I and II.
d. III and IV.
Solution: a (II and IV)
I. Incorrect. The consequence—the PID’s profits covering its losses—occurs after the risk has
materialized.
II. Correct. Trigger event is the correct term for the divestment mandate.
III. Incorrect. The risk event is the PID’s decision to sell.
IV. Correct. The intermediate events were the unexpected predictions for a long-sought upturn in
the economy.
An advertising agency that has experienced steady growth for a decade gathers its staff
together for a control risk self-assessment (CRSA) and identifies the following top concerns:
I. Heavy reliance “legacy” on former clients rather than cultivating new clients.
II. High staff turnover. Only the CEO and the award-winning creative director have been with the
firm since inception.
III. Effects of the economy on each business sector they serve.
IV. The firm’s new focus on a global, rather than a regional, market.
Which of the above risks represents a potential single point of failure?
a. Risk I.
b. Risk II.
c. Risk III.
d. Risk IV.
Solution: b
a. Incorrect. Business development needs to be addressed but is not a single point of failure. The
agency can implement a business development plan to address this issue in the time frame
necessary.
b. Correct. The critical human capital asset is the firm’s creative director, both in terms of talents
and relationships with clients. If the creative director leaves, the agency will lack the key talent
that differentiates it from its competitors.
c. Incorrect. This is an ongoing risk that should be addressed by the agency as changes in the
economy warrant.
d. Incorrect. This is an ongoing risk that should be addressed by the agency but is not a single
point of failure.
Two real-estate investment partners are assessing the relative risks of a prime property in Los
Angeles, California, and a comparable property in a similarly vibrant area of Brooklyn, New
York. One partner discounts heavily the value of the Los Angeles property because of the
potential for earthquake damage. The Los Angeles-averse partner is most likely influenced by
which element of risk management analysis?
a. Risk psychology.
b. Risk prioritization.
c. Risk severity.
d. Risk response.
Solution: a
a. Correct. Risk psychology addresses the perceived level of acceptable risk based on an
individual’s personal perceptions and thus individual risk appetite. Risk psychology also notes
that the “psychological weight” that an individual associates with a risk is based primarily upon
impact and not likelihood, and that the perceived impact is dependent upon one’s ability to
control or intervene in an event.
b. Incorrect. Although one partner may prioritize the risk of an earthquake higher than the other
partner, risk prioritization is an aggregated profile of all risks in the enterprise’s portfolio
consistent with the general attitude of the enterprise.
c. Incorrect. Risk severity measures the “level of the inherent risk, defined as the magnitude of a
combination of risks, expressed in terms of the … consequences and likelihood.” In this
instance, likelihood is (correctly or incorrectly) distorted due to the psychological weight of the
potential impact.
d. Incorrect. Risk response refers to the level of response an enterprise feels is appropriate to take
as a result of a risk materializing.
Which of the following is not a benefit of risk mapping and prioritization?
a. The results help an enterprise to communicate better its risk aggregated risk profile to key
external stakeholders.
b. Ranking risks by their level of severity helps an organization determine the optimal allocation of
resources devoted to risk response or treatment.
c. Risk maps are key graphical representations of the variance in risk appetites across different
divisions within an organization.
d. Helping the enterprise identify how certain risks can offset other risks to ensure that the
enterprise maintains an overall risk profile that remains within risk capacity.
Solution: c
a. Incorrect. This is a key benefit of risk mapping and prioritization as external stakeholders are
interested in the overall, not the segmented, risk profile of the organization.
b. Incorrect. This is a key benefit for management that arises from risk mapping and prioritization.
c. Correct. While risk appetite may well vary in different divisions of an organization, the
objective of mapping and prioritization exercises is to compare the overall risk profile against
the total risk capacity of the enterprise.
d. Incorrect. This is a key benefit for management that arises from risk mapping and prioritization.
A city comptroller was the sole signatory on the city’s accounts. Over two decades she
embezzled $30 million from the municipality by shifting public funds through multiple city
bank accounts before hiding them in a secret account. Despite regular external audits, her
fraud went undetected until a colleague discovered the secret bank account. What are the
most likely reasons that this fraud was perpetuated over such a long time?
I. Incomplete understanding of the risk conditions leading to a faulty risk response mechanism.
II. The cost of treating the risk to keep the level within appetite outweighed the benefits gained
from treating the risk.
III. Inadequate directive controls.
IV. Inadequate preventative controls.
a. II, III, and IV.
b. I and III only.
c. I and IV only.
d. I, II, and III
Solution: c (I and IV only)
I. Correct. Fraud is often considered a low probability/moderately high impact risk and, as such,
the municipality should have considered adjustments to routine operations and other treatments.
Given that the comptroller was in a very powerful position and the only signatory on the
accounts, this risk could also have been elevated to a medium probability risk that required closer attention. Regardless of the classification, the municipality appears to have tolerated the
risk when it should have treated the risk.
II. Incorrect. Low-cost preventative and detective controls, such as requiring an additional signatory
and having periodic internal reviews of the comptroller’s books, would have been a good
investment, especially compared to the significant loss of public funds and the likely attendant
loss of public confidence in its government.
III. Incorrect. Directive controls, such as accounting manuals, training and supervision, and strategic
plans, encourage desired behaviors and outcomes. While these are valid controls, the
comptroller’s senior position and lack of a co-signer translated into a lack of supervision. These
longstanding conditions left the city vulnerable to fraud. It is unlikely that manuals, training, or
strategic plans would have been strong enough deterrents given the lack of meaningful
preventative and detective controls.
IV. Correct. These are controls designed to stop or limit the possibility of an undesirable event from
happening. Key examples are segregation of duties, access controls, and authorization
procedures.
Community Hospital Systems (CHS) set a goal that all patients be seen within 30 days of their
requests. Employees who met the scheduling goal were rewarded with bonuses.
Unbeknownst to senior executives, schedulers were entering fraudulent data into the
scheduling system to disguise the much longer actual wait time. Significant numbers of
patients experienced deteriorating health, and several died before seeing a medical
professional. Which of the following were the primary drivers behind the fraudulent
reporting?
I. A bureaucracy that had been taught over time to hide its problems from senior management.
II. Incomplete or inappropriate reliance on performance metrics.
III. Reducing treatment wait time was an inappropriate operating objective. Therefore, CHS did not
deploy its resources effectively to achieve its strategic objectives.
IV. Lack of alignment between its organizational objectives and risk management processes.
a. I and II only.
b. II and III only.
c. III and IV only.
d. II and IV only.
Solution: d (II and IV)
I. Incorrect. The bureaucratic culture should be examined to determine whether it was a factor
contributing to the fraud, but the scenario’s stem does not give us the data to determine whether
this was the case.
II. Correct. CHS placed primary emphasis on the treatment wait time metric and, as a result, the
system did not reward CHS for the quality of its service and outcomes, but rather by metrics that
were easily manipulated.
III. Incorrect. The desire to reduce treatment wait time is not an inherently incorrect operating
objective. The failure to recognize and monitor the risks introduced by its organizational
objectives (IV) and its flawed performance and incentive structure (II) are the primary
conditions that enabled the fraud.
IV. Correct. Achieving alignment between organizational objectives and risk management processes
is key to ERM. CHS failed to recognize and monitor the risks introduced by its organizational
objectives, performance metrics, and reward structure.
A summer camp is known for its expertise in wilderness training and adventures. The camp
carries $50 million of liability insurance, and parents of campers must sign liability waivers.
All counselors are certified in wilderness first aid and activity instruction and are required to
undergo periodic refresher training. All campers receive training and must meet stringent
skill and safety requirements before embarking on a wilderness trip. Which two response
options best summarize the camp’s risk response strategy?
I. Avoid.
II. Transfer.
III. Mitigate.
IV. Tolerate.
a. II and III.
b. I and II.
c. II and IV.
d. III and IV.
Solution: a (II and III)
I. Incorrect. The activities that give rise to the risks are core to the purpose of the organization.
The camp cannot avoid or terminate these risks.
II. Correct. Both the required liability waivers and the liability insurance covering the camp
apportion some of the risk to a third party.
III. Correct. Ensuring that counselors are highly trained instructors, leaders, and athletes and
requiring that the campers demonstrate adequate preparedness before participating in a
wilderness trip are strong mitigation responses for inherently risky activities.
IV. Incorrect. The option to tolerate or accept a risk is best suited for low-probability, low-impact
risks. The camp correctly assessed that risk levels associated with its core activities require more
proactive responses.
The term risk escalation refers to:
a. Risks that have materialized as events.
b. Weaknesses in the internal control system that raise residual risks beyond the limits of the risk
appetite.
c. The increase in an enterprise’s risk profile resulting from previously unknown risks arising from
changes in the internal or external environments or changes to the organization’s objectives and
activities.
d. The process of and procedures for reporting risk incidents up the chain of command.
Solution: d
a. Incorrect. This is the definition of “risk incidents.”
b. Incorrect. Still, identification of such weaknesses is a critical component of strong risk
management reporting.
c. Incorrect. This is the definition of an emerging risk.
d. Correct. The purpose of escalation is “partly to keep managers informed of risk incidents as well
as to precipitate implementation of a contingency plan.”
Put the following risk identification activities in the proper sequence: I. Develop initial risk register. II. Conduct Control Risk Self-Assessment (CRSA). III. Calculate risk severity. IV. Define the risk universe. a. I, II, III, and IV. b. II, IV, I, and III. c. II, III, IV, and I. d. III, IV, II, and I.
Solution: b (II, IV, I, and III)
I. Development of the risk register is the third in the series of activities. The risk register documents
the results of risk identification and the definition of the risk universe. It also assigns risk owners
who are responsible for monitoring, responding, and reporting. As risk analyses and evaluations
are conducted, and risk monitoring and response plans are developed, the risk register will also
be updated to incorporate these data.
II. CRSA is a highly structured, participatory approach to identifying risks. A CRSA could include a
variety of risk assessment exercises such as questionnaires, brainstorming sessions or workshops,
and vulnerability assessments. A CRSA or its components would be the first activity in this risk
identification series of events.
III. Determining risk severity is the last step in the series and occurs after risk identification
exercises are conducted or updated.
IV. Defining the risk universe is the second step in the series. Sobel and Reding’s steps to move from
a list of identified risks toward a more detailed articulation of the risk universe include
consideration of the possible outcomes of the risks and defining and grouping risks according to
similar sources, causes, or related impacts.
- CRSA
- Define the risk universe
- Risk register (owners)
- Risk severity
An information broker, InfoMart, suffered an information security breach that exposed
hundreds of thousands of customers’ sensitive personal information. The breach was a result
of fraud perpetrated by criminals pretending to be legitimate customers. In addition to heavy
fines and redress costs, the company is now on probation subject to 20 years of external
auditing by the Federal Trade Commission. What would be the most important improvement
that InfoMart should make to avoid future breaches?
a. Implement better IT general controls and IT application controls, with special emphasis on
automating controls that force employees to adhere to policies affecting change management
and access rights as well as authentication and authorization of system users.
b. Make the chief information security officer (CISO) responsible for monitoring vulnerabilities in
business processes and IT.
c. Strengthen business processes for vetting customers and their activities and create offices of
customer credentialing, compliance, and privacy that would report directly to the board of
directors’ privacy committee.
d. Eliminate products that contain personal data regarding an individual’s financial assets, criminal
and employment histories, and known associates/family members.
Solution: c
a. Incorrect. While strong IT controls are critical elements of risk management, there is no
evidence that the criminals exploited vulnerabilities in IT policies, architecture, or software.
b. Incorrect. While CISOs have come to be regarded as protectors of information, no matter the
threat, the CISO must work in concert with a number of divisions tackling privacy and security
from different angles, such as a corporate credentialing center, a compliance and privacy
division, and internal audit.
c. Correct. InfoMart should create the organizational infrastructure and policies that will allow it
to employ an integrated monitoring and detection defense against fraud.
d. Incorrect. These knowledge services were core to the businesses’ mission, and the elimination of
these data would be an existential threat to InfoMart.
Risk severity is often calculated as a function of likelihood, categorized as “unlikely,”
“possible,” or “likely,” and impact, categorized as “catastrophic,” “disruptive,” or
“problematic.” Using the InfoMart case above and the study guide’s definitions of likelihood
and impact categories, one would most likely assign a likelihood of ___________ and an impact of
___________ to a future InfoMart data breach:
a. Unlikely, disruptive.
b. Unlikely, catastrophic.
c. Likely, problematic.
d. Possible, disruptive.
Solution: d
a. Incorrect. Unlikely is defined as “May occur once in a working life, such as premises being
destroyed by fire.” The nature of security threats is that they always evolve and require ongoing
offensive and defensive measures. Realistically, InfoMart can only decrease the likelihood of
another breach to possible.
b. Incorrect. Catastrophic is defined as “requiring nearly all of the management team to focus all of
its attention on responding to the problem such as destruction of main premises or financial
losses that threaten total reserves.” See also the discussion of unlikely in rationale a.
c. Incorrect. Likely is defined as “May occur more than once a year, such as being unable to access
emails.” InfoMart’s responses to its prior data breach should decrease likelihood to possible.
Furthermore, problematic is defined as requiring “a few of the management team to focus some
of its attention on responding to the problem.” Maintaining the integrity of InfoMart’s data
requires that key members of InfoMart’s management continue to focus on an enterprise-wide
response.
d. Correct. Possible is defined as “May occur every few years, such as an industrial action or
terrorist (intruder) incident.” The nature of data security is that data are constantly exposed to
threats, which can, however, be mitigated to within acceptable levels. Disruptive is defined in
part as requiring “some of the management team to focus the majority of their attention to
responding to the problem.” Repeated breaches will weaken InfoMart’s brand as a provider of
reliable data. Key members of InfoMart’s management will need to focus on maintaining the
real and perceived integrity of the data it supplies to its customers.
What is the greatest challenge that is unique to conducting and interpreting risk
prioritization exercises?
a. Likelihood and impact are not the only risk criteria that the organization needs to consider.
b. The assumption that different risk criteria (such as likelihood and impact) carry equal weight in
the analysis.
c. Attaching numbers to measures of risk requires a degree of subjectivity and judgment.
d. Risk analysis, evaluation, and prioritization are processes that require regular updates.
Solution: b
a. Incorrect. There are other criteria to consider, but analysts can add columns to the matrix to
account for other factors such as volatility and velocity.
b. Correct. For example, a high likelihood multiplied by medium impact comes out with the same
numeric severity score as medium likelihood multiplied by high impact.
c. Incorrect. While subjectivity presents challenges, it can be redressed if practitioners articulate
clearly the parameters associated with a numeric score, especially if aided with examples.
d. Incorrect. Regular review, revision, and updating are essential to all risk management processes
to ensure they are aligned with the organizational context. These requirements are not unique to
conducting and interpreting risk prioritization exercises.
According to COSO guidance, the term sweet spot refers to:
a. Identifying and investing the optimal amount of money devoted to risk management.
b. The point at which the aggregate risk exposure of different divisions in an enterprise are
balanced in accordance with overall risk appetite.
c. An enterprise achieving a state in which overall risk profile is equal to its total risk capacity.
d. The point at which an organization’s risk-taking results in the highest net gain in value.
Solution: d
a. Incorrect. Optimal risk management requires more than determining the desired amount of
resources devoted to determining, implementing, and monitoring risk and risk responses.
b. Incorrect. While an organization must ensure it has a balanced portfolio of risk that meets the
general risk attitude, having a balanced portfolio is not necessarily sufficient to obtain the sweet
spot. It is possible that an enterprise that has balanced its risks across divisions is nonetheless so
risk averse that it fails to achieve better net results in return for undertaking additional risk
(insufficient risk-taking). Conversely, an organization with a balanced portfolio of risk may have
an overall risk attitude that translates into excessive risk-taking.
c. Incorrect. While this is a goal of risk management, it is not COSO’s definition of the sweet spot.
d. Correct. Furthermore, “finding the sweet spot and manipulating risk to keep it there is the
purpose of risk management.”
Review or audit of risk management processes has three primary goals. Which of the following is not one of the three goals?
a. To identify and repair weaknesses and faults.
b. To avoid impugning the reputation of top management.
c. To identify changes in the organization’s objectives and environment and ensure alignment.
d. To determine that the organization is achieving its goals (because risk management is working).
Solution: b
a. Incorrect. Identified as a goal in Enterprise Risk Management: Achieving and Sustaining Success
(Sobel and Reding, 2012).
b. Correct. Not identified as a goal by Sobel and Reding.
c. Incorrect. Same as a.
d. Incorrect. Same as a.
A corporation uses a risk management plan form that includes a section on methodology with the following steps: I. Control risks. II. Monitor risks. III. Risk response tracking. IV. Risk response planning. V. Prioritize risks. VI. Risk identification. VII. Categorize risks. VIII. Risk impact assessment. Which is the logical sequence of the above steps? a. I, II, III, VIII, IV, VII, VI, V. b. VI, VII, VIII, V, IV, III, II, I. c. VIII, VII, VI, V, IV, III, II, I. d. VI, VII, IV, III, II, VIII, V.
Solution: b (VI, VII, VIII, V, IV, III, II, I)
a. Incorrect. Illogical sequence, i.e., consideration of risks precedes those of control.
b. Correct. Logical (and found in use).
c. Incorrect. Illogical sequence, e.g., risk identification precedes planning.
d. Incorrect. Illogical, e.g., prioritization cannot be the last step.
In a school cafeteria, an employee was accused of stealing $500 a day in cash by operating a
cash only line for a la carte items, without a cash register. The employee was charged with
stealing more than $1 million over 20 years. Effective monitoring should have identified the
following as red flags except:
a. Large amounts of an asset (cash) with inherent risk.
b. Absence of a cash register in the a la carte line.
c. Lack of monitoring of ratio of inventory consumption for the a la carte line to the ratio for four
cash receipts lines.
d. Lack of an annual ethics briefing for all employees.
Solution: d
a. Incorrect. A commonly recognized red flag.
b. Incorrect. Again, a common red flag, especially when cash is the only form of revenue.
c. Incorrect. This should have been an additional red flag in view of a and b.
d. Correct. It is unlikely that an annual ethics briefing would influence the behavior of a long-term
thief.
