Risk Assessment & Mitigation Flashcards
7 cards from real CRM practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Risk Assessment & Mitigation flashcards as text
Which of the following BEST describes a Business Impact Analysis (BIA) in the context of records risk?
Answer: An assessment of how records loss or unavailability would affect critical business operations
A BIA identifies the operational, financial, and legal consequences of losing access to critical records, informing recovery priorities.
An organization retains records beyond their mandated retention period 'just in case.' What risk does this practice introduce?
Answer: Over-retention risk, including increased eDiscovery costs and potential liability
Retaining records beyond their approved retention period increases litigation exposure, storage costs, and the volume of potentially discoverable information.
Which concept describes the point in time to which data must be restored after a disaster, representing acceptable data loss?
Answer: Recovery Point Objective (RPO)
The RPO defines how much data loss is tolerable by specifying the maximum acceptable age of restored records following a disruption.
A risk register in records management should include all of the following EXCEPT:
Answer: Employee personal performance reviews
A risk register documents identified risks, their assessments, owners, and mitigation plans—not individual employee performance data.
Which mitigation strategy is MOST appropriate when a records management risk cannot be eliminated but must be reduced to an acceptable level?
Answer: Implementing compensating controls
When risks cannot be fully eliminated, compensating controls—such as redundant backups or access logging—reduce risk to an acceptable threshold.
Which of the following represents a 'people risk' in records management?
Answer: An employee emailing sensitive records to a personal account
People risks arise from human actions—intentional or accidental—such as employees mishandling or exfiltrating sensitive records.
When developing a records disaster recovery plan, the FIRST step should be to:
Answer: Identify vital records that are essential to resume operations
Identifying vital records is the foundational step because recovery resources and priorities must focus on the records indispensable for operational continuity.