Risk Assessment & Mitigation Flashcards

When calculating a risk's Expected Monetary Value (EMV), which formula is used?

Answer: EMV = Impact × Probability

Expected Monetary Value is calculated by multiplying the monetary impact of a risk by its probability of occurrence.

A software manager purchases cybersecurity insurance to cover losses from a potential data breach. This is an example of:

Answer: Risk transference

Purchasing insurance transfers the financial consequences of a risk to a third party (the insurer).

Which of the following best describes a 'residual risk'?

Answer: The remaining risk after mitigation actions have been applied

Residual risk is the level of risk that remains after mitigation strategies have been implemented.

A software manager identifies a risk but decides to watch it closely over the next two weeks before taking action. This approach is called:

Answer: Risk monitoring (watchlist)

Placing a risk on a watchlist means actively monitoring it without immediately allocating resources, pending further information.

In a risk register, which field records the planned actions to reduce a risk's probability or impact?

Answer: Mitigation plan

The mitigation plan field documents the specific actions planned to reduce the probability or impact of the identified risk.

A software project is 60% complete when a key integration risk the team accepted earlier actually occurs. What should the manager do first?

Answer: Activate the contingency plan

When an accepted risk occurs, the first step is to activate any pre-defined contingency plan to manage the impact.

Which technique uses optimistic, pessimistic, and most likely estimates to model schedule risk?

Answer: PERT (Program Evaluation and Review Technique)

PERT uses three-point estimates (optimistic, pessimistic, most likely) to account for schedule uncertainty and risk.