Risk Management

Question 1

Risk Management

Answer 1

Fundamental process involving identification, analysis, treatment, monitoring, and reporting of risks

Question 2

Risk Management Lifecycle (double check if this is correct)

Answer 2

Risk Identification
 Proactive process recognizing potential risks
 Goal
 Create a comprehensive list based on events hindering
objectives

Risk Analysis
 Evaluate likelihood and potential impact
 Qualitative or quantitative methods
 Outcome
 Prioritized list for guiding risk treatment

Risk Treatment
 Develop strategies
 Avoidance
 Reduction
 Sharing
 Acceptance

Risk Monitoring
 Ongoing process tracking identified risks
 Monitor residual risks, identify new risks, and review
risk management effectiveness
 Ensures dynamic responsiveness to organizational
changes

Risk Reporting
 Communicate risk information and effectiveness of risk
management to stakeholders
 Various forms
 Dashboards
 Heat Maps
 Detailed Reports
 Crucial for accountability and informed decision-
making

Question 3

4 Risk Assessment Frequency types

Answer 3

 Ad-hoc
 Recurring
 One-time
 Continuous

Question 4

Risk Identification concepts

Answer 4

 Recovery Time Objective
 Recovery Point Objective
 Mean Time to Repair
 Mean Time Before Failure

Question 5

Qualitative Riak Analysis vs Quantitative Risk Analysis

Answer 5

Qualitative Risk Analysis
 Assess and prioritize risks based on likelihood and impact

Quantitative Risk Analysis
 Numerically estimate probability and potential impact

Question 6

4 Risk Management Strategy types

Answer 6

1 Risk Transfer
2 Risk Acceptance
3 Risk Avoidance
4 Risk Mitigation

Question 7

Business Impact Analysis (BIA)

Answer 7

 Evaluates effects of disruptions on business functions
 Identifies and prioritizes critical functions
 Assesses impact of risks on functions
 Determines required recovery time for functions

Question 8

4 Key Metrics in Business Impact Analysis (BIA)

Answer 8

1: Recovery Time Objective (RTO)
 Maximum acceptable time before severe impact
 Target time for restoring a business process

2: Recovery Point Objective (RPO)
 Maximum acceptable data loss measured in time
 Point in time data must be restored to

3: Mean Time to Repair (MTTR)
 Average time to repair a failed component or system
 Indicator of repair speed and downtime minimization

4: Mean Time Between Failures (MTBF)
 Average time between system or component failures
 Measure of reliability

Question 9

Define Risk Register

Answer 9

 Records identified risks, descriptions, impacts,
likelihoods, and mitigation actions
 Key tool in risk management
 May resemble a heat map risk matrix
 Facilitates communication and risk tracking
 Key component of project and business operations

Question 10

5 Components of Risk Register

Answer 10

1 Risk Description

2 Risk Impact

3 Risk Likelihood

4 Risk Outcome

5 Risk Level or Threshold

Question 11

Risk tolerance/acceptance vs risk appretite

Answer 11

Risk Tolerance/Risk Acceptance
 An organization or individual’s willingness to deal with
uncertainty in pursuit of their goals
 Maximum amount of risk they are willing to accept
 Acceptance without countermeasures

Risk Appetite
 Willingness to pursue or retain risk
Types:
 Expansionary
 Conservative
 Neutral

Question 12

Key Risk Indicators (KRIs)

Answer 12

 Predictive metrics signaling increasing risk exposure
 Provide early warning of potential risks
 Tied to the organization’s objectives
 Used to monitor risk changes and take proactive steps

Question 13

Define Qualitative Risk Analysis

Answer 13

Primary method in risk management
 Assesses risks based on potential impact and likelihood
 Categorizes risks as high, medium, or low
 Subjective and relies on expertise and experience
 Avoids quantitative complexity

Question 14

key components to Qualitative Risk Analysis

Answer 14

Likelihood/Probability
 Chance of risk occurrence
 Qualitatively expressed as low, medium, or high
 Based on past experience, statistical analysis, or expert
judgment

Impact
 Potential consequences if risk occurs
 Qualitatively rated as low, medium, or high
 Assess damage to project or business objectives

Impact Levels
Low Impact
 Minor damage, essential functions operational

Medium Impact 	Significant damage, loss to assets

     High Impact 	Major damage, essential functions impaired

Question 15

Define Quantitative Risk Analysis

Answer 15

 Provides objective and numerical evaluation of risks
 Used for financial, safety, and scheduling decisions

Question 16

5 Key components to Quantitative Risk Analysis

Answer 16

1: Exposure Factor (EF)
 Proportion of asset lost in an event (0% to 100%)
 Indicates asset loss severity

2: Single Loss Expectancy (SLE)
 Monetary value expected to be lost in a single event
 Calculated as Asset Value x Exposure Factor (EF)

4: Annualized Rate of Occurrence (ARO)
 Estimated frequency of threat occurrence within a year
 Provides a yearly probability

5: Annualized Loss Expectancy (ALE)
 Expected annual loss from a risk
 Calculated as SLE x ARO