Risk Management

Question 1

Amount of uncertainty that remains after all risk management efforts have been exhausted.

Answer 1

Residual risk

Question 2

Reporting of an organization’s violations of policies and processes by employees.

Answer 2

Whistleblowing

Question 3

Situation in which one party engages in risky behavior knowing that it is protected against the risk because another party will incur any resulting loss.

Answer 3

Moral hazard

Question 4

Expected monetary loss for an asset due to a risk over a one-year period; calculated by multiplying single loss expectancy by annualized rate of occurrence.

Answer 4

Annualized loss expectancy (ALE)

Question 5

Potential for harm, often associated with a condition or activity that, if left uncontrolled, can result in injury or illness.

Answer 5

Hazard

Question 6

Situation in which an agent (for example, an employee) makes decisions for a principal (for example, an employer) potentially on the basis of personal incentives that may not be aligned with the principal’s incentives.

Answer 6

Principal-agent problem

Question 7

Protocol that an organization implements when an identified risk event occurs.

Answer 7

Contingency plan

Question 8

Principle that organizations should take all steps that are reasonably possible to ensure the health, safety, and well-being of employees and protect them from foreseeable injury.

Answer 8

Duty of care

Question 9

Expected monetary loss every time a risk occurs; calculated by multiplying asset value by exposure factor.

Answer 9

Single loss expectancy (SLE)

Question 10

Organization’s desired gain or acceptable loss in value.

Answer 10

Risk position

Question 11

Tool used to gather individual assessments of various characteristics of risk (for example, frequency of occurrence; degree of impact, loss, or gain for the organization; degree of efficacy of current controls).

Answer 11

Risk scorecard

Question 12

Metrics that provide an early signal of increasing risk exposures for an enterprise.

Answer 12

Key risk indicators (KRIs)

Question 13

Uncertainty that has an effect on an objective, where outcomes may include opportunities, losses, and threats.

Answer 13

Risk

Question 14

Action taken to manage a risk.

Answer 14

Risk control

Question 15

A characterization of the amount of uncertainty (acceptable risk) an organization is willing to pursue or to accept to attain its risk management goals, defined in a range above and below a target.

Answer 15

Risk tolerance

Question 16

System for identifying, evaluating, and controlling actual and potential risks to an organization.

Answer 16

Risk management

Question 17

A high-level characterization of the amount of uncertainty (acceptable risk) an organization is willing to pursue or to accept to attain its risk management goals.

Answer 17

Risk appetite