Risk Management & Mitigation Flashcards
7 cards from real CPS practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Risk Management & Mitigation flashcards as text
In risk management, what does a 'risk register' primarily serve to document?
Answer: Identified risks, their likelihood, impact, and mitigation plans
A risk register is a formal record of identified risks along with their assessed likelihood, potential impact, owners, and planned mitigation or response actions.
Which risk response strategy involves shifting the financial impact of a risk to a third party?
Answer: Transfer
Risk transfer moves the financial consequences of a risk to another party, such as through insurance policies or contractual liability clauses.
What is 'residual risk' in the context of process risk management?
Answer: The risk remaining after mitigation controls have been implemented
Residual risk is the level of risk that remains after controls, mitigations, or other risk responses have been applied to a raw or inherent risk.
A process team identifies a risk but decides no action is needed because the cost of mitigation exceeds the expected loss. This is an example of:
Answer: Active risk acceptance
Active risk acceptance is a deliberate, documented decision to tolerate a risk, often because mitigation costs outweigh the potential impact.
Which quantitative technique uses repeated random sampling to model the probability distribution of process outcomes under uncertainty?
Answer: Monte Carlo simulation
Monte Carlo simulation runs thousands of scenarios using random variable inputs to produce a probability distribution of possible outcomes.
What is the purpose of a 'risk owner' assignment in a risk register?
Answer: To ensure one accountable person monitors and manages the specific risk
A risk owner is the individual held accountable for monitoring a specific risk and ensuring that the agreed response plan is executed effectively.
In a risk probability-impact matrix, a risk rated 'high probability / low impact' is typically managed how?
Answer: Accepted with monitoring, as combined exposure is moderate
High-probability but low-impact risks often fall into a moderate overall exposure zone and are typically watched or accepted rather than demanding urgent escalation.