CRA Risk Identification Principles 2 — Questions and Answers
Question 1: Which risk identification technique involves systematically examining each component of a system to determine how it could fail and the consequences of that failure?
- Fault Tree Analysis
- Failure Mode and Effects Analysis (FMEA) (Correct answer)
- Delphi Technique
- Root Cause Analysis
Correct answer: Failure Mode and Effects Analysis (FMEA)
FMEA systematically analyzes each component to identify potential failure modes and their effects on the overall system.
Question 2: In risk identification, what does the term 'velocity' refer to?
- The frequency with which a risk event repeats
- The speed at which a risk can impact the organization after it materializes (Correct answer)
- The rate at which risk exposure grows over time
- The speed of implementing risk controls
Correct answer: The speed at which a risk can impact the organization after it materializes
Risk velocity describes how quickly a risk can affect the organization once it has been triggered, influencing response time requirements.
Question 3: A risk architect is reviewing an organization's supply chain. Which approach best identifies risks that span multiple vendors and interdependencies?
- Individual vendor risk assessments conducted independently
- Bow-tie analysis focused on a single critical vendor
- End-to-end process mapping with cross-vendor dependency identification (Correct answer)
- A checklist review of contractual obligations
Correct answer: End-to-end process mapping with cross-vendor dependency identification
End-to-end process mapping reveals interdependencies and cascading risks across multiple vendors that isolated reviews would miss.
Question 4: Which of the following best describes a 'risk trigger' in the identification process?
- A threshold at which a risk is escalated to senior management
- An early warning indicator that signals a risk event may be imminent (Correct answer)
- The monetary value at which a risk requires insurance
- A control mechanism that prevents risk occurrence
Correct answer: An early warning indicator that signals a risk event may be imminent
A risk trigger is an early warning sign or condition that indicates a risk event is likely to occur, enabling proactive response.
Question 5: When using structured interviews for risk identification, what is the PRIMARY advantage over group workshops?
- Structured interviews are less time-consuming than workshops
- Interviews allow individuals to express concerns without group influence or anchoring bias (Correct answer)
- Interviews produce more quantitative risk data than workshops
- Structured interviews eliminate the need for a facilitator
Correct answer: Interviews allow individuals to express concerns without group influence or anchoring bias
One-on-one interviews prevent groupthink and anchoring bias, allowing interviewees to freely share risks they might suppress in a group setting.
Question 6: A CRA candidate reviews an organization's risk register and finds many risks are described as 'compliance failure' or 'cyber breach.' What is the main problem with these descriptions?
- They are too specific and limit the scope of risk monitoring
- They lack root cause context and confuse risk events with risk categories (Correct answer)
- They are appropriate for a high-level risk register
- They should only appear in operational risk registers, not enterprise ones
Correct answer: They lack root cause context and confuse risk events with risk categories
Broad category labels without root cause context make risks difficult to assess, own, or mitigate because they do not describe specific, actionable scenarios.
Question 7: Which risk identification tool uses a visual representation of causal relationships between a central risk event, its causes, and its consequences simultaneously?
- Influence diagram
- Bow-tie analysis (Correct answer)
- Ishikawa diagram
- Risk breakdown structure
Correct answer: Bow-tie analysis
Bow-tie analysis places the risk event at the center, displaying threat causes on the left and consequence pathways on the right in a single diagram.
CRA Risk Identification Principles 2
Which risk identification technique involves systematically examining each component of a system to determine how it could fail and the consequences of that failure?