Risk Mitigation Strategies & Decision-Making Flashcards

A risk manager uses a decision tree to evaluate whether to self-insure or purchase coverage. The decision tree is MOST useful because it:

Answer: Explicitly maps sequential choices and chance events with associated probabilities and payoffs

Decision trees structure multi-stage choices by mapping branching paths of decisions and probabilistic outcomes, enabling calculation of expected values at each node.

An organization implements a 'risk escalation protocol' that requires front-line managers to notify senior leadership when a risk exceeds a defined threshold. This protocol PRIMARILY addresses which governance weakness?

Answer: Information silos that prevent timely risk awareness at decision-making levels

Escalation protocols break down information silos by ensuring that material risks identified at operational levels reach executives who have authority and context to respond.

Which of the following BEST describes the concept of 'risk interdependency' in a portfolio context?

Answer: The occurrence of one risk event may increase the likelihood or severity of other risks

Risk interdependency (or contagion) means that risks are not independent; a triggering event can cascade and amplify other exposures, requiring portfolio-level thinking.

A financial institution uses stress testing to evaluate portfolio resilience. The MAIN limitation of historical stress scenarios (using past crisis data) is:

Answer: They may not capture novel risks or combinations of factors not seen in historical data

Historical stress scenarios are limited by the assumption that future crises will resemble past ones, missing new risk combinations, structural changes, or unprecedented events.

A risk analyst applies the 'minimax regret' criterion when evaluating strategies under uncertainty. This approach selects the option that:

Answer: Minimizes the maximum regret (opportunity loss) across all possible scenarios

Minimax regret selects the strategy whose worst-case 'regret'—the gap between the chosen outcome and the best possible outcome in that scenario—is the smallest.

A company negotiates a contractual indemnification clause with a vendor that shifts liability for data breaches to the vendor. This is BEST categorized as:

Answer: Contractual risk transfer

Contractual indemnification shifts financial liability for specified losses to another party by legal agreement, which is a form of non-insurance contractual risk transfer.

When building a business case for a risk mitigation investment, the MOST rigorous financial metric to compare the cost of controls against risk reduction is:

Answer: Return on risk mitigation investment (ROMI), calculated as risk reduction benefit minus control cost divided by control cost

ROMI quantifies the economic value of a control by comparing the reduction in expected loss (benefit) to the cost of implementing and maintaining the control.