Risk Management Test PDF

**What is risk management?** a. **Answer:** Risk management is the process of identifying, assessing, and controlling threats to an organisation in relation to its ability to provide its service and its financial, legislative and regulatory responsibilities. **Name the four main strat...

**What is risk management?** a. **Answer:** Risk management is the process of identifying, assessing, and controlling threats to an organisation in relation to its ability to provide its service and its financial, legislative and regulatory responsibilities. **Name the four main strategies for managing risk.** b. **Answer:** The four main strategies are avoidance, reduction, transference/share, and acceptance/retention. **What is a risk assessment?** c. **Answer:** A risk assessment is the process of identifying potential hazards and analysing what could happen if a hazard occurs. **Explain the difference between qualitative and quantitative risk assessment.** d. **Answer:** Qualitative risk assessment uses subjective judgement based on non-numerical data, while quantitative risk assessment uses numerical data and statistical methods. **What is a risk register?** e. **Answer:** A risk register is a tool used to document risks, their severity, and the action steps to manage them. **Define 'risk appetite'.** f. **Answer:** Risk appetite is the amount and type of risk that an organisation is willing to take in order to meet its strategic objectives. **What is the purpose of a risk management plan?** g. **Answer:** The purpose of a risk management plan is to outline how risk management will be performed on a project, including methodologies, tools, and techniques. **What is the difference between inherent risk and residual risk?** h. **Answer:** Inherent risk is the level of risk before any actions are taken to manage it, while residual risk is the level of risk remaining after risk management actions have been applied. **What is a risk matrix?** i. **Answer:** A risk matrix is a tool used to define the level of risk by considering the category of probability or likelihood against the category of consequence severity. **Explain the concept of 'risk transfer'.** j. **Answer:** Risk transfer involves shifting the risk to a third party, such as through insurance or outsourcing. **What is a 'risk owner'?** k. **Answer:** A risk owner is an individual responsible for managing a specific risk and ensuring that risk mitigation measures are implemented. **Describe the 'Bowtie' method in risk management.** l. **Answer:** The Bowtie method is a risk evaluation technique that visualises the pathways from causes to consequences of a risk event, showing preventive and mitigative controls. **What is the role of internal audit in risk management?** m. **Answer:** Internal audit provides independent assurance that an organisation's risk management, governance, and internal control processes are operating effectively. **What is 'risk tolerance'?** n. **Answer:** Risk tolerance is the specific maximum risk that an organisation is willing to take regarding each relevant risk. **Explain the term 'risk mitigation'.** o. **Answer:** Risk mitigation involves taking steps to reduce the adverse effects of potential risks. **What is a 'risk indicator'?** p. **Answer:** A risk indicator is a metric used to measure the level of risk exposure or the effectiveness of risk controls. It is an 'early warning trigger' if used effectively and maintained. **What is the difference between 'risk avoidance' and 'risk reduction'?** q. **Answer:** Risk avoidance involves eliminating the risk entirely, while risk reduction involves taking steps to reduce the likelihood or impact of the risk. **What is 'risk communication'?** r. **Answer:** Risk communication is the process of sharing information about risk between decision-makers and stakeholders. **What is the purpose of a 'risk workshop'?** s. **Answer:** A risk workshop is a collaborative session where stakeholders identify and assess risks, and collectively develop strategies to manage them. **Explain the concept of 'risk culture'.** t. **Answer:** Risk culture refers to the values, beliefs, knowledge, and understanding about risk shared by a group of people with a common purpose, particularly within an organisation. **What is the purpose of risk identification?** u. **Answer:** The purpose of risk identification is to determine which risks might affect the project/activity. **What is a 'risk event'?** v. **Answer:** A risk event is an occurrence that has a negative or positive effect on organisational objectives. **Explain the term 'risk response planning'.** w. **Answer:** Risk response planning involves developing options and actions to enhance opportunities and reduce threats to project/activity/organisational objectives. **What is a 'contingency plan'?** x. **Answer:** A contingency plan is a predefined action plan that is implemented if a specific risk event occurs. **Define 'risk escalation'.** y. **Answer:** Risk escalation is the process of transferring a risk to a higher level of authority when it cannot be managed at the current level. **What is 'risk aggregation'?** z. **Answer:** Risk aggregation is the process of combining multiple risks to understand their collective impact on the project. **What are the AS/NZS ISO (and year) for Risk Management.** a. **Answer:** ISO 31000:2009 **What is 'risk impact/consequence'?** b. **Answer:** Risk impact is the effect or consequence of a risk event on project/activity/organisational objectives. **What is a 'risk threshold'?** c. **Answer:** A risk threshold is the level of risk exposure above which risks are addressed and below which risks may be accepted. **Describe 'risk monitoring and control'.** d. **Answer:** Risk monitoring and control involves tracking identified risks, monitoring residual risks, identifying new risks, and evaluating risk process effectiveness throughout the project. **What is 'risk appetite statement'?** e. **Answer:** A risk appetite statement is a formal declaration of the amount and type of risk an organisation is willing to pursue or retain. **What is 'risk diversification'?** f. **Answer:** Risk diversification involves spreading risk across different areas to reduce the impact of any single risk. **Explain 'risk prioritisation'.** g. **Answer:** Risk prioritisation is the process of ranking risks based on their probability and impact to determine which risks to address first. **What is 'risk communication plan'?** h. **Answer:** A risk communication plan outlines how risk information will be communicated to stakeholders, including the frequency and format of communication. **Define 'risk tolerance level'.** i. **Answer:** Risk tolerance level is the degree of variability in outcomes that an organisation is willing to withstand. **What is 'risk acceptance'?** j. **Answer:** Risk acceptance is a risk response strategy where no action is taken to address a risk because its impact is deemed acceptable. **Explain 'risk avoidance strategy'.** k. **Answer:** Risk avoidance strategy involves changing the project plan to eliminate the risk or protect the project objectives from its impact. **What is 'risk exploitation'?** l. **Answer:** Risk exploitation is a strategy to ensure that opportunities are realised by taking proactive steps to make the opportunity happen. **Describe 'risk sharing'.** m. **Answer:** Risk sharing involves distributing the risk among multiple parties, such as through partnerships, joint ventures, or insurance. **What is 'risk reassessment'?** n. **Answer:** Risk reassessment is the periodic review of risks to identify new risks, reassess current risks, and evaluate the effectiveness of risk responses. Incorrect Answers 1. **What is risk management?** - A. The process of eliminating all risks. - B. The process of ignoring potential threats. - C. The process of only focusing on financial risks. 2. **Name the four main strategies for managing risk.** - A. Ignorance, denial, acceptance, and avoidance. - B. Avoidance, ignorance, sharing, and denial. - C. Reduction, ignorance, acceptance, and denial. 3. **What is a risk assessment?** - A. The process of creating risks. - B. The process of ignoring hazards. - C. The process of eliminating all hazards. 4. **Explain the difference between qualitative and quantitative risk assessment.** - A. Qualitative uses numerical data, quantitative uses subjective judgement. - B. Qualitative is always more accurate than quantitative. - C. Quantitative does not use any data. 5. **What is a risk register?** - A. A tool used to eliminate risks. - B. A document that lists only financial risks. - C. A register that ignores risk severity. 6. **Define 'risk appetite'.** - A. The amount of risk an organisation is unwilling to take. - B. The desire to avoid all risks. - C. The amount of risk that is ignored by an organisation. 7. **What is the purpose of a risk management plan?** - A. To ignore risks. - B. To eliminate all risks. - C. To document only financial risks. 8. **What is the difference between inherent risk and residual risk?** - A. Inherent risk is after controls, residual risk is before controls. - B. Residual risk is always higher than inherent risk. - C. Inherent risk is always lower than residual risk. 9. **What is a risk matrix?** - A. A tool used to create risks. - B. A document that lists only minor risks. - C. A matrix that ignores risk probability. 10. **Explain the concept of 'risk transfer'.** - A. Transferring risk to an internal department. - B. Ignoring the risk. - C. Eliminating the risk entirely. 11. **What is a 'risk owner'?** - A. Someone who creates risks. - B. An individual who ignores risks. - C. A person responsible for eliminating all risks. 12. **Describe the 'Bowtie' method in risk management.** - A. A method that ignores risk causes. - B. A technique that only focuses on financial risks. - C. A method that eliminates all risks. 13. **What is the role of internal audit in risk management?** - A. To create risks. - B. To ignore risks. - C. To eliminate all risks. 14. **What is 'risk tolerance'?** - A. The level of risk an organisation is unwilling to take. - B. The desire to avoid all risks. - C. The amount of risk that is ignored by an organisation. 15. **Explain the term 'risk mitigation'.** - A. Ignoring risks. - B. Eliminating all risks. - C. Creating new risks. 16. **What is a 'risk indicator'?** - A. A metric used to create risks. - B. A tool that ignores risk exposure. - C. A measure that eliminates risks. 17. **What is the difference between 'risk avoidance' and 'risk reduction'?** - A. Risk avoidance involves reducing the risk. - B. Risk reduction involves eliminating the risk. - C. Risk avoidance involves accepting the risk. 18. **What is 'risk communication'?** - A. The process of ignoring risk information. - B. Sharing information only about financial risks. - C. The process of eliminating risks. 19. **What is the purpose of a 'risk workshop'?** - A. To create risks. - B. To ignore risks. - C. To eliminate all risks. 20. **Explain the concept of 'risk culture'.** - A. The values and beliefs about ignoring risks. - B. The knowledge about creating risks. - C. The understanding of eliminating all risks. 21. **What is the purpose of risk identification?** - A. To create risks. - B. To ignore risks. - C. To eliminate all risks. 22. **What is a 'risk event'?** - A. An occurrence that has no effect on project objectives. - B. An event that always has a positive effect. - C. An event that is always ignored. 23. **Explain the term 'risk response planning'.** - A. Planning to ignore risks. - B. Planning to create risks. - C. Planning to eliminate all risks. 24. **What is a 'contingency plan'?** - A. A plan to ignore risks. - B. A plan to create risks. - C. A plan to eliminate all risks. 25. **Define 'risk escalation'.** - A. The process of ignoring risks. - B. The process of creating risks. - C. The process of eliminating risks. 26. **What is 'risk aggregation'?** - A. Combining risks to ignore them. - B. Combining risks to create new ones. - C. Combining risks to eliminate them. 27. **What are the AS/NZS ISO (and year) for Risk Management.** - A. ISO 35100: 2008 - B. ISO 39100: 2012 - C. ISO 51100: 2009 28. **What is 'risk impact'?** - A. The effect of a risk that is ignored. - B. The consequence of a risk that is always positive. - C. The impact of a risk that is always negative. 29. **What is a 'risk threshold'?** - A. The level of risk exposure that is ignored. - B. The threshold above which risks are eliminated. - C. The level of risk exposure that is always acceptable. 30. **Describe 'risk monitoring and control'.** - A. Tracking risks to ignore them. - B. Monitoring risks to create new ones. - C. Controlling risks to eliminate them. 31. **What is 'risk appetite statement'?** - A. A statement about ignoring risks. - B. A declaration of the risks an organisation will not take. - C. A statement about eliminating all risks. 32. **What is 'risk diversification'?** - A. Spreading risk to ignore it. - B. Concentrating risk in one area. - C. Eliminating risk by spreading it. 33. **Explain 'risk prioritisation'.** - A. Ranking risks to ignore them. - B. Prioritising risks to create new ones. - C. Ranking risks to eliminate them. 34. **What is 'risk communication plan'?** - A. A plan to ignore risk information. - B. A plan to communicate only financial risks. - C. A plan to eliminate risks. 35. **Define 'risk tolerance level'.** - A. The level of risk variability that is ignored. - B. The degree of risk that is always unacceptable. - C. The level of risk that is always tolerated. 36. **What is 'risk acceptance'?** - A. Accepting risks to ignore them. - B. Accepting risks to create new ones. - C. Accepting risks to eliminate them. 37. **Explain 'risk avoidance strategy'.** - A. Avoiding risks to ignore them. - B. Avoiding risks to create new ones. - C. Avoiding risks to eliminate them. 38. **What is 'risk exploitation'?** - A. Exploiting risks to ignore them. - B. Exploiting risks to create new ones. - C. Exploiting risks to eliminate them. 39. **Describe 'risk sharing'.** - A. Sharing risks to ignore them. - B. Sharing risks to create new ones. - C. Sharing risks to eliminate them. 40. **What is 'risk reassessment'?** - A. Reassessing risks to ignore them. - B. Reassessing risks to create new ones. - C. Reassessing risks to eliminate them. Correct answers 1. **What is risk management?** - The process of identifying, assessing, and controlling threats to an organisation's capital and earnings. 2. **Name the four main strategies for managing risk.** - Avoidance, reduction, sharing, and retention. 3. **What is a risk assessment?** - The process of identifying potential hazards and analysing what could happen if a hazard occurs. 4. **Explain the difference between qualitative and quantitative risk assessment.** - Qualitative uses subjective judgement; quantitative uses numerical data. 5. **What is a risk register?** - A tool used to document risks, their severity, and action steps to manage them. 6. **Define 'risk appetite'.** - The amount and type of risk an organisation is willing to take to meet its objectives. 7. **What is the purpose of a risk management plan?** - To outline how risk management will be performed on a project. 8. **What is the difference between inherent risk and residual risk?** - Inherent risk is before controls; residual risk is after controls. 9. **What is a risk matrix?** - A tool to define risk levels by considering probability and impact. 10. **Explain the concept of 'risk transfer'.** - Shifting the risk to a third party, such as through insurance. 11. **What is a 'risk owner'?** - An individual responsible for managing a specific risk. 12. **Describe the 'Bowtie' method in risk management.** - A technique that visualises pathways from causes to consequences of a risk event. 13. **What is the role of internal audit in risk management?** - To provide independent assurance on risk management processes. 14. **What is 'risk tolerance'?** - The specific maximum risk an organisation is willing to take. 15. **Explain the term 'risk mitigation'.** - Taking steps to reduce the adverse effects of potential risks. 16. **What is a 'risk indicator'?** - A metric used to measure risk exposure or control effectiveness. 17. **What is the difference between 'risk avoidance' and 'risk reduction'?** - Avoidance eliminates the risk; reduction lowers its likelihood or impact. 18. **What is 'risk communication'?** - Sharing information about risk between decision-makers and stakeholders. 19. **What is the purpose of a 'risk workshop'?** - A session where stakeholders identify and assess risks and develop strategies. 20. **Explain the concept of 'risk culture'.** - The values, beliefs, and understanding about risk shared within an organisation. 21. **What is the purpose of risk identification?** - To determine which risks might affect the project and document their characteristics. 22. **What is a 'risk event'?** - An occurrence that has a negative or positive effect on project objectives. 23. **Explain the term 'risk response planning'.** - Developing options and actions to enhance opportunities and reduce threats. 24. **What is a 'contingency plan'?** - A predefined action plan implemented if a specific risk event occurs. 25. **Define 'risk escalation'.** - Transferring a risk to a higher authority when it cannot be managed at the current level. 26. **What is 'risk aggregation'?** - Combining multiple risks to understand their collective impact. 27. **Explain the concept of 'risk probability'.** - The likelihood that a risk event will occur. 28. **What is 'risk impact'?** - The effect or consequence of a risk event on project objectives. 29. **What is a 'risk threshold'?** - The level of risk exposure above which risks are addressed. 30. **Describe 'risk monitoring and control'.** - Tracking identified risks, monitoring residual risks, and evaluating risk process effectiveness. 31. **What is 'risk appetite statement'?** - A formal declaration of the amount and type of risk an organisation is willing to pursue or retain. 32. **What is 'risk diversification'?** - Spreading risk across different areas to reduce the impact of any single risk. 33. **Explain 'risk prioritisation'.** - Ranking risks based on their probability and impact to determine which to address first. 34. **What is 'risk communication plan'?** - Outlines how risk information will be communicated to stakeholders. 35. **Define 'risk tolerance level'.** - The degree of variability in outcomes that an organisation is willing to withstand. 36. **What is 'risk acceptance'?** - A strategy where no action is taken because the risk's impact is deemed acceptable. 37. **Explain 'risk avoidance strategy'.** - Changing the project plan to eliminate the risk or protect objectives from its impact. 38. **What is 'risk exploitation'?** - Ensuring opportunities are realised by taking proactive steps. 39. **Describe 'risk sharing'.** - Distributing the risk among multiple parties, such as through partnerships or insurance. 40. **What is 'risk reassessment'?** - Periodic review of risks to identify new risks and evaluate the effectiveness of responses.