Week 4 Flashcards
What is the definition of risk mitigation?
Risk mitigation involves implementing measures to reduce the likelihood and impact of identified risks.
What are the four main risk mitigation strategies?
Avoidance, Reduction, Sharing, and Acceptance.
What is risk avoidance?
Eliminating activities or conditions that expose the organization to risk.
What is risk reduction?
Implementing controls to reduce the likelihood or impact of risks.
What is risk sharing?
Transferring or sharing the risk with other parties, such as purchasing insurance or outsourcing activities.
What is risk acceptance?
Acknowledging the risk and choosing to accept it without additional controls, such as setting aside contingency funds.
What are preventive controls?
Controls that aim to reduce the likelihood of an event happening, such as car seat belts or segregation of duties.
What are detective controls?
Controls that aim to detect events during or just after they occur, such as smoke detectors or file reconciliations.
What are corrective controls?
Controls that aim to mitigate impacts after an event, such as redundancies, backups, or crisis communication strategies.
What is self-certification/inquiry in control testing?
An interview with the control owner, limited to low-risk or secondary controls due to lack of evidence.
What is examination in control testing?
Review of supporting documentation that provides moderate assurance and suits automated controls.
What is observation in control testing?
Real-time oversight of control execution, suitable for key controls to assess design and effectiveness.
What is reperformance in control testing?
The most rigorous test, replicating control processes on sample transactions; provides the highest assurance, recommended for high-risk environments.
What are optimistic controls?
Controls that rely on exceptional ability or motivation, often becoming superficial ‘tick-box’ tasks, such as last-minute sign-offs on large document volumes.
What are duplicative controls?
Controls where more than one person reviews the same information (e.g., ‘four-eyes check’), which can dilute accountability and reduce focus.
What are slips in human error typology?
Involuntary errors due to distraction, inattention, or poor work environments.
What are rule-based mistakes in human error typology?
Voluntary but incorrect actions caused by flawed or conflicting rules.
What are knowledge-based mistakes in human error typology?
Voluntary but incorrect actions resulting from unfamiliarity or lack of training.
What are violations in human error typology?
Deliberate disregard for rules, mitigated by supervision and strong organizational culture.
What is the difference between active and latent errors?
Active errors are direct operator actions (e.g., pressing the wrong button), while latent errors are flawed processes or systems that only manifest later.
What is risk transfer?
Moving the consequence or causes of a risk to another party, often via insurance or outsourcing.
Why can’t reputational risk be outsourced?
Because the reputation of the organization remains tied to its name and brand, regardless of who performs the activities.
What are the key components of a risk mitigation plan?
Risk description, mitigation measures, responsibilities, resources, and timeline.
What is Root Cause Analysis (RCA)?
A systematic process used to identify the underlying causes of problems or incidents to prevent recurrence.
