Risk Management Flashcards
Annualized loss expectancy (ALE)
Expected monetary loss for an asset due to a risk over a one-year period; calculated by multiplying single loss expectancy by annualized rate of occurrence.
Conflict of Interest
Situation in which a person or organization may benefit from undue influence due to involvement in outside activities, relationships, or investments that conflict with or have an impact on the employment relationship or its outcomes.
Contingency plan
Protocol that an organization implements when an
identified risk event occurs.
Duty of care
Principle that organizations should take all steps that
are reasonably possible to ensure the health, safety,
and well-being of employees and protect them from
foreseeable injury.
Hazard
Potential for harm, often associated with a condition or
activity that, if left uncontrolled, can result in injury or
illness.
Key risk indicators (KRIs)
Metrics that provide an early signal of increasing risk
exposures for an enterprise.
Moral hazard
Situation in which one party engages in risky behavior
knowing that it is protected against the risk because
another party will incur any resulting loss.
Principal-agent problem
Situation in which an agent (for example, an employee)
makes decisions for a principal (for example, an
employer) potentially on the basis of personal incentives
that may not be aligned with the principal’s incentives.
Residual risk
Amount of uncertainty that remains after all risk
management efforts have been exhausted.
Risk
Uncertainty that has an effect on an objective, where
outcomes may include opportunities, losses, and threats.
Risk appetite
A high-level characterization of the amount of uncertainty
(acceptable risk) an organization is willing to pursue or to
accept to attain its risk management goals.
Risk control
Action taken to manage a risk.
Risk management
System for identifying, evaluating, and controlling actual
and potential risks to an organization.
Risk position
Organization’s desired gain or acceptable loss in value.
Risk scorecard
Tool used to gather individual assessments of various
characteristics of risk (for example, frequency of
occurrence; degree of impact, loss, or gain for the
organization; degree of efficacy of current controls).
Risk tolerance
A characterization of the amount of uncertainty
(acceptable risk) an organization is willing to pursue or to
accept to attain its risk management goals, defined in a
range above and below a target.
Single loss expectancy (SLE)
Expected monetary loss every time a risk occurs; calculated by multiplying asset value by exposure factor.
Whistleblowing
Reporting of an organization’s violations of policies and
processes by employees.
Which risk category would include the risk posed by infectious disease?
Hazard
Financial
Strategic
Operational
Hazard
The hazard risk category includes risk sources from injury and illness. Infectious disease would fall under this risk category.
Which evaluation method is best for an emergency response plan?
Comparing the plan to the previous plan
Asking for insurance company input
Conducting a crisis drill
Having a government agency review the plan
Conducting a crisis drill
A simulated crisis in which the plan is tested will alert the company to changes that need to be made and is the best way to see how the plan performs.
Which option best defines risk?
Quantifiable and enterprise-wide picture of organization loss exposure.
Negative impact an event can exert on an organization’s well-being
Organization’s vulnerabilities from an enterprise perspective
Effect of uncertainty on the ability to meet organization objectives.
Effect of uncertainty on the ability to meet organization objectives.
The ISO definition of risk is simply “the effect of uncertainty on objectives.” Uncertainty can be positive or negative in its effects. The other choices emphasize negative risk or assessments of risk occurrence.
An employee’s ex-husband waits outside her place of work. When she emerges, he begins yelling. She retreats inside the building. The husband attempts to follow but is prevented by a door that locks automatically behind the employee. An HR staff member observes the incident. What action should the staff member take?
Answers
Call for immediate revision of the organization’s security policies.
Recommend that those involved debrief the incident.
Write a memo to the HR head, documenting the incident.
None. The security measures worked as intended.
Recommend that those involved debrief the incident.
After-action debriefs are a good way to examine the effectiveness of a specific risk response strategy, presenting an opportunity for learning and improvement.
Which situation that leads to workplace violence can be controlled by an organization?
Answers
Domestic problems
Pressure for increased productivity
Low employee self-esteem
Unstable economy
Pressure for increased productivity.
Conditions causing employee frustration and anger can lead to violence. Examples include pressure for productivity, rigid management style, and layoffs.
What is the appropriate role for an HR manager in an investigatory interview for a dischargeable offense?
Answers
Champion of employee’s perspective and position
Prosecutor presenting evidence and challenging the employee
Risk manager for the organization
Supporter for manager/supervisor of involved department
Risk manager for the organization.
In this situation, the role of HR is to be proactive and manage the legal and physical safety risks to the organization. HR managers must be aware of the need to ensure due process to employees and to provide a safe work environment for all employees. HR should not take a prosecutorial or defense role; the organization should approach the situation and the evidence objectively and calmly.
What phase of risk management is represented in the acronym MECE, which stands for “mutually exclusive and comprehensively exhaustive”?
Answers
Risk-averse
Risk management
Risk identification
Risk mitigation
Risk identification
The organization wants to be confident that all plausible risks for strategic and oeprational aspects of the business avoid duplication or overlapping in the identification step.
Which best identifies the outcome of requiring all employees to be trained in business continuity and disaster recovery plans?
Decreased size of risk management budgets
Decreased risk of occurrence of risk events
Increased risk of poor public relations
Increased confidence among organization shareholders
Increased confidence among organization shareholders.
Preparation for crises and business interruptions demonstrates quality management practices and would boost stakeholder confidence and public image. It would not affect the likelihood of occurrence, nor would it decrease risk management budgets.
