Deck 23: Identifying and Managing Risks

Question 1

Which of the following is a type of risk related to when a risk may occur?

A) Strategic risks
B) Risks of scale
C) Risks of timing
D) Structure-related risks
E) Operational risks

Answer 1

C

Question 2

An organisation in which the same risk may be dealt with differently in different areas of the organisation, or one area may unintentionally undermine the efforts of another area, would be said to have:

A) a weak risk culture.
B) a strong risk culture.
C) an effective risk management system.
D) low risk tolerance.
E) None of these responses are correct.

Answer 2

A

Question 3

Which one of the following analytical tools is not a framework that can be used to understand the context of risk?

A) PEST analysis
B) STEEP analysis
C) Scenario planning
D) SWOT analysis
E) Cause-and-effect diagram

Answer 3

C

Question 4

The roles and accountabilities of an organisation's board, management, risk committees and any internal risk management specialists would be found in its:

A) risk management register.
B) risk management plan.
C) risk management policies.
D) risk management system.
E) risk management protocols.

Question 5

Which of the following statements describes a risk management principle that forms a part of effective risk management?

A) It encourages continual improvement.
B) It is included in decision making.
C) It is tailored to suit the organisation's needs and goals.
D) It creates value for the organisation.
E) All of these responses are correct.

Question 6

A fire started by lightning that burns down an organisation's business premises is an example of:

A) an operational risk.
B) a reputational risk.
C) an intrinsic risk.
D) an external risk.
E) a strategic risk.

Question 7

Which of the following shows the correct order of a risk management process?

A) Identify, evaluate, analyse, treat
B) Identify, analyse, evaluate, treat
C) Identify, analyse, treat, evaluate
D) Identify, treat, analyse, evaluate
E) Identify, evaluate, treat, analyse

Question 8

Which of the following would not be included in a risk management plan (RMP) in relation to a specific risk?

A) What the organisation is doing to enhance the risk
B) What the organisation is doing to remove the risk
C) What the organisation is doing to control the risk
D) The level of loss an organisation is prepared to accept from the risk
E) Contingency plans to be put in place should the risk occur

Question 9

If an organisation was willing to invest all its capital in developing and producing a new product that it believed would dominate the market, but that, if it were to fail, would bankrupt them, then the organisation would be said to have:

A) no risk tolerance.
B) some risk tolerance.
C) low risk tolerance.
D) high risk tolerance.
E) None of these responses are correct.

Question 10

While social media has been an effective marketing tool in promoting organisations and their products and services, it also comes with high risk due to the lack of control an organisation has in relation to the speed with which it can damage an organisation's brand, image and reputation.

Question 11

Risks that remain after treatment has already occurred (i.e. after risk control measures have been put in place) are known as:

A) inherent risks.
B) residual risks.
C) tolerable risks.
D) registered risks.
E) managed risks.

Question 12

Choose the best answer. To build a healthy risk culture in which employees pay attention to all kinds of risks, all the time, and deal with them appropriately:

A) risk analysis needs to be incorporated into the organisation's strategic planning and decision making and its organisation's various management systems.
B) risk management planning needs to be incorporated into the organisation's operational planning and decision making and its organisation's various management systems.
C) risk management planning does not need to be incorporated into the organisation's strategic planning and decision making or its various management systems.
D) risk analysis and risk management planning need to be incorporated into the organisation's operational planning and decision making and its various management systems.
E) risk analysis and risk management planning need to be incorporated into the organisation's strategic, business and operational planning and decision-making and its various management systems.

Question 13

What is the first step in developing a solid risk management framework (RMF)?

A) Identifying clear risk policies
B) Consulting with relevant stakeholders
C) Establishing a mandate for and commitment from the organisation's leadership
D) Conducting a risk analysis
E) Conducting risk monitoring and review

Question 14

An organisation's risk culture describes:

A) how aware an organisation is of risks and their potential effects on the organisation, employees at all levels and all parts of the organisation.
B) how aware an organisation is of opportunities and their potential effects on the organisation, employees at all levels and all parts of the organisation.
C) how conscious employees are of the role they play in controlling risks and opportunities.
D) how conscious employees are of the role they play in optimising risks and opportunities.
E) All of these responses are correct.

Question 15

Measures ensuring that knowledge and skills are distributed across geographically dispersed offices would be found in an organisation's:

A) business continuity plans.
B) disaster recovery plans.
C) business impact analysis.
D) business evaluation plans.
E) contingency plans.

Question 16

It is impossible for an organisation to have zero appetite for risks relating to governance, legislative compliance and workplace health and safety (WHS), yet at the same time a high risk appetite for research and development of new products and business models where the failure rate might be high, but the returns great.

Question 17

A fall in consumer demand for an organisation's products due to people spending less that causes the business to make less profit is an example of an external risk related to:

A) information technology.
B) pandemic.
C) Mother Nature.
D) the government.
E) the economy.

Question 18

Effective risk management allows higher risks to be taken by organisations in the pursuit of opportunities and goals.

Question 19

Risk management is about avoiding risks, where possible, and dealing with them on an ad hoc, case-by-case basis.

Question 20

Who in an organisation is responsible for identifying and managing risk?

A) Everyone - all employees and all managers
B) The organisation's board of directors
C) Risk event management teams
D) Risk management committees
E) Risk owners

Question 21

An identified and named risk; its impact; the date it was identified, reviewed and updated; its cause; as well as pre- and post-risk control measures would all be likely to be found in a:

A) risk register.
B) heat map.
C) risk consequence table.
D) risk/opportunity matrix.
E) None of these responses are correct.

Question 22

According to the hierarchy of risk management, the least preferred option for dealing with risk is to:

A) eliminate the risk.
B) prevent the risk from occurring.
C) reduce the consequences of the risk should it occur.
D) reduce the likelihood of the risk occurring.
E) None of these responses are correct.

Question 23

With which stakeholders should an organisation communicate and consult in relation to risk management?

A) Employees
B) Employees, contractors and suppliers
C) Any stakeholders involved in or affected by the risks facing the organisation
D) All of the organisation's stakeholders
E) Only those stakeholders affected by the risks facing the organisation

Question 24

A risk falling within a yellow zone on a heat map needs to be monitored closely, because it could:

A) have moderate consequences, but be almost certain to occur.
B) have severe consequences, even though it is a very unlikely to occur.
C) have major consequences and possibly occur.
D) have severe consequences and possibly occur.
E) All of these responses are correct.

Question 25

A risk consequence table is a tool that can be used to:

A) list the consequences that would follow in the event of a risk occurring.
B) rank the severity of consequences based on their impact in the event of a risk occurring.
C) rank the severity of consequences based on their impact and duration in the event of a risk occurring.
D) determine the likelihood of exposure to a risk.
E) determine the frequency of exposure to a risk.

Question 26

Choose the best answer. Enlisting a third party, such as an insurance company or contractor, to take ownership or responsibility for a risk is an example of:

A) avoiding a risk by removing its source.
B) accepting a risk.
C) rejecting an unacceptable risk.
D) transferring a risk.
E) reducing a risk to an acceptable level through controls or preventative measures.

Question 27

Working through your critical resources and value chain as part of a risk management process is part of:

A) identifying risks.
B) analysing risks.
C) evaluating risks.
D) treating risks.
E) avoiding risks.

Question 28

Regular reviews of a risk management plan (RMP) allow an organisation to:

A) proactively re-examine the risks it faces.
B) proactively re-examine its evaluation of the risks it faces.
C) analyse the strengths and weaknesses of the RMP.
D) identify opportunities to improve and update the RMP so that it will reflect changing circumstances inside and outside the organisation.
E) All of these responses are correct.

Question 29

What is the final component of a documented risk management plan (RMP)?

A) The treatment/s selected for each risk
B) The action items needed to implement the RMP
C) Identification of the management and control structures needed to execute the RMP
D) A list of resources the program needs
E) A review process that involves stakeholders and encourages continuous improvement, innovation and learning

Question 30

An organisation's culture (including risk culture) and values, when viewed in the context of a SWOT analysis, would be considered to be:

A) external factors which are strengths.
B) external factors which are weaknesses.
C) internal factors which are strengths.
D) external factors which could be either strengths or weaknesses.
E) internal factors which could be either strengths or weaknesses.