I85PREP
⌘ K
SAMRA study materials
SAMRA study resources

SAMRA practice questions

One question at a time. Build your SAMRA understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamentals of Risk Management and Risk Assessment

In risk management terminology, what does the term 'inherent risk' describe?

  1. The portion of risk transferred to a third party through insurance
  2. The risk created by the act of auditing a control environment
  3. The risk that remains after controls have been implemented and verified
  4. The level of risk before any controls or mitigation measures are applied Correct answer.

Explanation

Inherent risk is the exposure that exists in a process or activity in its untreated state, before any mitigating controls are considered. It provides the baseline against which the effect of controls, and therefore residual risk, can be measured.

Question 2Fundamentals of Risk Management and Risk Assessment

A risk assessment team estimates that a supplier failure would cost approximately $2 million if it occurred. Which component of risk does this estimate represent?

  1. Appetite
  2. Likelihood
  3. Velocity
  4. Impact Correct answer.

Explanation

Impact (or consequence) quantifies the severity of the outcome if the event occurs, here expressed in monetary terms. Likelihood is a separate dimension describing how probable the event is, and the two are typically combined to derive a risk rating.

Question 3Fundamentals of Risk Management and Risk Assessment

An analyst multiplies the likelihood score of a risk by its impact score to place risks on a heat map. Which risk assessment approach does this illustrate?

  1. Control self-assessment
  2. Quantitative assessment
  3. Semi-quantitative assessment Correct answer.
  4. Qualitative assessment

Explanation

Semi-quantitative assessment assigns numeric scales to likelihood and impact and combines them arithmetically, producing ordered rankings without true financial measurement. It sits between purely descriptive qualitative ratings and fully modeled quantitative analysis.

Question 4Fundamentals of Risk Management and Risk Assessment

Which statement best describes the purpose of a risk register?

  1. It serves as a central log of identified risks with owners, ratings, and treatment status Correct answer.
  2. It documents the technical configuration of IT systems
  3. It lists the regulatory penalties applicable to the organization
  4. It records the organization's financial statements for external reporting

Explanation

A risk register is the primary tracking tool in risk management, capturing each identified risk along with its assessment, assigned owner, and the status of any response. It supports monitoring and reporting across the risk lifecycle.

Question 5Fundamentals of Risk Management and Risk Assessment

An organization decides to purchase cyber insurance to cover potential breach costs. Which risk treatment option has been applied?

  1. Acceptance
  2. Transfer Correct answer.
  3. Reduction
  4. Avoidance

Explanation

Transfer shifts the financial consequence of a risk to a third party, and insurance is the classic example. The underlying risk event may still occur, but the loss burden is contractually shared with the insurer.

Question 6Fundamentals of Risk Management and Risk Assessment

A risk has been assessed as low likelihood but catastrophic impact. Which statement about this risk profile is most accurate?

  1. It can be ignored because likelihood is low
  2. It is automatically classified as a residual risk
  3. It must always be avoided regardless of cost
  4. It may warrant contingency planning despite the low probability Correct answer.

Explanation

Low-likelihood, high-impact risks are often called tail risks and may justify contingency or continuity planning even when they are unlikely. Ignoring them because of low probability understates the potential severity of the outcome.

Question 7Fundamentals of Risk Management and Risk Assessment

What is the primary role of a risk owner?

  1. To approve the annual financial budget
  2. To hold accountability for managing a specific risk and its response Correct answer.
  3. To calculate the organization's overall risk appetite
  4. To independently audit the organization's control environment

Explanation

A risk owner is the individual accountable for a defined risk, including ensuring appropriate treatment and monitoring are in place. This accountability distinguishes the owner from control operators and independent assurance functions.

Question 8Fundamentals of Risk Management and Risk Assessment

During a risk assessment workshop, participants rate a risk's likelihood as 'possible' and its impact as 'major'. Which characteristic of this assessment is most significant?

  1. It relies on expert judgment and defined rating scales Correct answer.
  2. It eliminates subjectivity from the process
  3. It requires statistical modeling of historical data
  4. It produces a precise monetary loss estimate

Explanation

Workshop-based ratings using defined scales are qualitative assessments that draw on participant expertise and judgment. They are structured but remain subjective, which is why calibration and clear scale definitions matter.

Question 9Fundamentals of Risk Management and Risk Assessment

Which of the following best defines risk appetite?

  1. The maximum loss the organization could survive financially
  2. The speed at which a risk event propagates through systems
  3. The total number of risks recorded in the risk register
  4. The amount and type of risk an organization is willing to pursue or retain Correct answer.

Explanation

Risk appetite expresses the level and nature of risk an organization is prepared to accept in pursuit of its objectives. It guides decision-making and is often operationalized through risk tolerance thresholds.

Question 10Fundamentals of Risk Management and Risk Assessment

A control is described as 'preventive'. Which example best matches this classification?

  1. A monthly reconciliation that detects discrepancies after posting
  2. An access restriction that blocks unauthorized users before entry Correct answer.
  3. An incident review meeting held after a breach
  4. A backup restored after a data loss event

Explanation

Preventive controls act before an event occurs to stop it or reduce its likelihood, such as access restrictions blocking entry. Detective and corrective controls operate after the fact to identify or remediate issues.

Question 11Fundamentals of Risk Management and Risk Assessment

An organization sets a threshold stating that no single risk may exceed a 5% probability of causing more than $500,000 in loss. What does this threshold represent?

  1. Risk velocity
  2. Risk aggregation
  3. Risk tolerance Correct answer.
  4. Risk register scope

Explanation

Risk tolerance translates appetite into concrete, measurable limits that define acceptable variation around objectives. Specifying probability and loss thresholds gives decision-makers a testable boundary.

Question 12Fundamentals of Risk Management and Risk Assessment

When performing a risk assessment, why is it important to define the scope and objectives first?

  1. To satisfy insurance policy conditions automatically
  2. To ensure the assessment focuses on relevant processes and produces usable results Correct answer.
  3. To guarantee that no risk will be identified outside the scope
  4. To eliminate the need for a risk register

Explanation

Clear scope and objectives ensure the assessment addresses the right processes, stakeholders, and decisions, preventing wasted effort and irrelevant findings. Without them, results may be inconsistent and hard to act upon.

Question 13Fundamentals of Risk Management and Risk Assessment

A risk assessment identifies that a key employee holds all knowledge of a critical process. Which risk category does this most directly illustrate?

  1. Strategic risk
  2. Operational risk Correct answer.
  3. Compliance risk
  4. Market risk

Explanation

Concentration of knowledge in a single individual is an operational risk arising from people and process dependencies. It threatens continuity of day-to-day operations rather than market positions or strategic direction.

Question 14Fundamentals of Risk Management and Risk Assessment

Which statement best explains the relationship between inherent risk, controls, and residual risk?

  1. Inherent risk is calculated after residual risk is measured
  2. Controls increase inherent risk by adding complexity
  3. Residual risk equals inherent risk regardless of controls
  4. Residual risk is inherent risk adjusted by the effect of implemented controls Correct answer.

Explanation

Residual risk is what remains after controls have been applied to the inherent exposure, so effective controls reduce it. Assessing both values helps determine whether controls are proportionate and working.

Question 15Fundamentals of Risk Management and Risk Assessment

An analyst wants to compare the aggregate risk exposure of two business units with very different revenue sizes. Which approach is most appropriate?

  1. Normalize risk exposure against a relevant base such as revenue or capital Correct answer.
  2. Use qualitative labels without any comparison
  3. Rank risks only by likelihood
  4. Compare absolute loss estimates directly

Explanation

Normalizing exposure against a consistent base allows meaningful comparison between units of different scale. Absolute figures alone can mislead when the underlying operations differ greatly in size.

Question 16Fundamentals of Risk Management and Risk Assessment

What is the main purpose of performing a risk assessment at regular intervals rather than only once?

  1. To capture changes in the environment, controls, and risk profile over time Correct answer.
  2. To satisfy a one-time documentation requirement
  3. To replace the need for management review
  4. To reduce the number of risks in the register permanently

Explanation

Risk is dynamic, and changes in threats, operations, and controls can alter exposure, so periodic reassessment keeps ratings current. A one-time assessment quickly becomes stale and may misdirect resources.

Question 17Fundamentals of Risk Management and Risk Assessment

A company chooses to stop offering a product line because the associated regulatory risk is unacceptable. Which risk treatment option is this?

  1. Reduction
  2. Avoidance Correct answer.
  3. Transfer
  4. Acceptance

Explanation

Avoidance eliminates the risk by discontinuing the activity that generates it. It is appropriate when the exposure exceeds appetite and cannot be economically mitigated or transferred.

Question 18Fundamentals of Risk Management and Risk Assessment

Which factor most directly increases the likelihood component of a risk assessment for a legacy IT system?

  1. The number of users trained on the system
  2. The system's location in a data center
  3. The system's high replacement cost
  4. The growing number of unpatched known vulnerabilities Correct answer.

Explanation

Unpatched vulnerabilities raise the probability that a threat will successfully exploit the system, which is a likelihood driver. Cost and location affect impact or context but do not directly change the chance of occurrence.

Question 19Fundamentals of Risk Management and Risk Assessment

In a risk matrix, what does moving from a 'low' to a 'high' zone typically trigger?

  1. Removal of the risk from the register
  2. Automatic closure of the risk
  3. Escalation to senior management and prioritized treatment Correct answer.
  4. Reclassification of the risk as an opportunity

Explanation

Higher-rated risks generally require escalation and prioritized response because they exceed acceptable thresholds. The matrix is a communication and triage tool that directs attention and resources.

Question 20Fundamentals of Risk Management and Risk Assessment

A risk assessment concludes that a control is 'effective'. What does this most reasonably mean?

  1. The control operates as designed and reduces the risk to an acceptable level Correct answer.
  2. The control is documented in a policy manual
  3. The control is the most expensive option available
  4. The control has been approved by the board

Explanation

Effectiveness concerns whether a control actually functions as intended and achieves the desired reduction in risk. Documentation and approval support operation but do not by themselves prove effectiveness.

Question 21Fundamentals of Risk Management and Risk Assessment

Which of the following is the best example of an external risk source for an organization?

  1. Changes in industry regulation imposed by a government body Correct answer.
  2. Insufficient staff training on internal policy
  3. Weak segregation of duties within the finance team
  4. A poorly designed internal approval workflow

Explanation

External risk sources originate outside the organization's control, such as regulatory, economic, or environmental changes. Internal sources stem from the organization's own processes, people, or systems.

Question 22Fundamentals of Risk Management and Risk Assessment

An analyst notes that two risks, if they occur together, would cause losses far greater than the sum of each alone. Which concept does this describe?

  1. Control testing frequency
  2. Risk correlation and concentration Correct answer.
  3. Risk appetite
  4. Risk register completeness

Explanation

When risks are positively correlated or concentrated in the same area, combined losses can exceed the simple sum of individual estimates. Portfolio-level assessment must account for such dependencies rather than treating risks in isolation.

Question 23Fundamentals of Risk Management and Risk Assessment

What distinguishes a key risk indicator (KRI) from a key performance indicator (KPI)?

  1. A KRI is always financial, while a KPI is always non-financial
  2. A KRI replaces the need for a risk register
  3. A KRI measures risk exposure and early warning signals, while a KPI measures achievement of objectives Correct answer.
  4. A KRI is used only by auditors, while a KPI is used only by operations

Explanation

KRIs are metrics designed to signal changes in risk exposure and provide early warning, whereas KPIs track progress toward performance goals. Both can be financial or non-financial, and they serve complementary purposes.

Question 24Fundamentals of Risk Management and Risk Assessment

A risk assessment team finds that a previously rated 'high' risk has decreased after new controls were deployed. What should happen next?

  1. The risk owner should be reassigned automatically
  2. The risk should be deleted from the register
  3. The rating and supporting evidence should be updated and the change documented Correct answer.
  4. The controls should be removed to restore the original rating

Explanation

When controls change the exposure, the register should be updated to reflect the new residual rating with supporting evidence. Documenting the rationale maintains an auditable record of how the assessment evolved.

Question 25Fundamentals of Risk Management and Risk Assessment

Which scenario best illustrates residual risk that exceeds the organization's risk tolerance?

  1. A risk fully eliminated by discontinuing the activity
  2. A risk whose post-control rating remains above the approved threshold Correct answer.
  3. A risk that has never been identified in the register
  4. A risk that has been transferred entirely through insurance

Explanation

Residual risk above the tolerance threshold signals that current treatment is insufficient and further action or escalation is needed. Tolerance defines the boundary against which post-control exposure is compared.

Question 26Fundamentals of Risk Management and Risk Assessment

Which statement best describes the difference between a hazard and a risk in a formal risk assessment?

  1. A hazard is always acceptable, while a risk is by definition unacceptable to the organization.
  2. A hazard is a source of potential harm, while a risk combines the likelihood of that harm with its consequences. Correct answer.
  3. A hazard is a quantified probability, while a risk is a qualitative description of an uncertain event.
  4. A hazard exists only in physical workplaces, while a risk applies only to financial exposures.

Explanation

In formal risk terminology a hazard is the source or driver of potential harm, whereas risk expresses the combination of the likelihood of an event and the severity of its consequences. This distinction matters because hazard identification is a first step, and risk assessment then evaluates how likely and how serious the resulting harm could be.

Question 27Fundamentals of Risk Management and Risk Assessment

An organization classifies a supplier failure as an operational risk rather than a strategic risk. Which characteristic most supports this classification?

  1. The event originates in the day-to-day processes and resources the organization relies on to deliver its services. Correct answer.
  2. The event is driven by changes in interest rates and foreign exchange movements.
  3. The event is caused by a deliberate decision taken by the board about long-term market positioning.
  4. The event results from new legislation that changes the organization's legal obligations.

Explanation

Operational risk arises from people, processes, systems, and external events affecting everyday delivery, so a supplier failure disrupting regular operations fits that category. Strategic risk instead relates to high-level choices about markets, business models, and competitive positioning.

Question 28Fundamentals of Risk Management and Risk Assessment

A risk register records a risk with an owner, a description, and a status, but no assessment of likelihood or consequence. Which deficiency does this represent?

  1. The register cannot be used because registers must be maintained only by auditors.
  2. The register lacks the analytical basis needed to prioritize the risk against others. Correct answer.
  3. The register has been over-engineered by adding descriptive fields.
  4. The register has too many owners assigned to a single risk entry.

Explanation

A register is a prioritization and monitoring tool, and prioritization depends on assessed likelihood and consequence. Without those ratings, the organization cannot compare the entry against other risks or decide where to direct treatment resources.

Question 29Fundamentals of Risk Management and Risk Assessment

Which statement correctly distinguishes risk avoidance from risk reduction as treatment options?

  1. Avoidance is a monitoring activity, while reduction is a reporting activity.
  2. Avoidance eliminates the activity that generates the risk, while reduction lowers likelihood or impact while keeping the activity. Correct answer.
  3. Avoidance lowers the impact of an event, while reduction eliminates the underlying hazard entirely.
  4. Avoidance transfers the financial consequence to a third party, while reduction accepts the consequence without action.

Explanation

Avoidance means exiting the activity or exposure altogether so the risk no longer exists, whereas reduction (mitigation) retains the activity but applies controls that lower likelihood, impact, or both. The two options differ in whether the underlying exposure is removed or merely managed.

Question 30Fundamentals of Risk Management and Risk Assessment

A risk assessment team assigns likelihood using a five-point scale but does not define what each point means. What is the most likely consequence for the assessment's reliability?

  1. The assessment will be invalid because scales must always contain exactly ten points.
  2. Different assessors will interpret the scale differently, producing inconsistent and poorly comparable ratings. Correct answer.
  3. The assessment will be unaffected because likelihood is an objective property of the risk.
  4. The assessment will automatically default to the highest likelihood rating for all risks.

Explanation

Rating scales require explicit definitions or anchors so that assessors apply the same meaning to each level. Without them, judgment varies between individuals and across sessions, undermining comparability and any aggregation of results.

Question 31Fundamentals of Risk Management and Risk Assessment

In a bow-tie analysis, what is the function of the barriers placed on the left-hand side of the diagram?

  1. They are escalation triggers that notify regulators of the incident.
  2. They are preventive barriers intended to stop the threat from developing into the top event. Correct answer.
  3. They are documentation artifacts that record the audit trail of the analysis.
  4. They are recovery barriers intended to limit consequences after the top event has occurred.

Explanation

A bow-tie diagram places threats on the left, the top event in the center, and consequences on the right. Left-side barriers are preventive controls that interrupt the path from a threat to the top event, while right-side barriers are mitigative or recovery controls.

Question 32Fundamentals of Risk Management and Risk Assessment

A risk assessment uses a matrix where likelihood and impact are multiplied to give a score, and a risk scores 16 on a 5x5 grid. Which interpretation is most defensible?

  1. The score proves the risk will cause a loss of 16 units of currency in the next year.
  2. The score means the risk has both maximum likelihood and maximum impact.
  3. The score is a relative ranking value whose meaning depends on the thresholds defined for that matrix. Correct answer.
  4. The score indicates the risk is acceptable because it is below the maximum of 25.

Explanation

Multiplicative matrix scores are ordinal or relative indicators used to rank risks and compare them against defined thresholds. They do not represent monetary loss, and they do not by themselves establish acceptability.

Question 33Fundamentals of Risk Management and Risk Assessment

An analyst records a risk event that has already occurred and caused a loss, and logs it separately from forward-looking risks. What is this record commonly called?

  1. A control self-assessment questionnaire.
  2. An incident or loss event record used to feed historical data back into the risk assessment. Correct answer.
  3. A risk appetite statement approved by the board.
  4. A residual risk statement describing exposure after controls.

Explanation

Events that have already happened and produced loss are captured as incidents or loss events, and the resulting data improves future likelihood estimates. Forward-looking risks describe potential future events, which is why the two are logged separately.

Question 34Fundamentals of Risk Management and Risk Assessment

Two departments assess the same shared risk and produce very different ratings. Which action best supports a consistent organizational view of that risk?

  1. Average the two ratings without discussion and publish the arithmetic mean.
  2. Reconcile the assessments using common criteria and agreed scale definitions, then assign a single owner for the consolidated rating. Correct answer.
  3. Retain both ratings independently and report only the lower one to management.
  4. Escalate both ratings to the board and let each department act on its own assessment.

Explanation

Inconsistent ratings for the same risk usually reflect differing criteria, assumptions, or scale interpretations. Reconciliation against shared definitions, followed by a single accountable owner, produces a defensible consolidated view instead of parallel incompatible figures.

Question 35Fundamentals of Risk Management and Risk Assessment

A risk is rated high on impact and low on likelihood, and the organization decides to purchase insurance covering that specific loss. Which treatment category does this represent?

  1. Risk reduction, because the probability of the event is lowered.
  2. Risk transfer, because the financial consequence is shifted to a third party. Correct answer.
  3. Risk acceptance, because no action is taken to address the exposure.
  4. Risk avoidance, because the underlying activity is discontinued.

Explanation

Insurance shifts the financial burden of a defined loss to the insurer, which is the classic form of risk transfer. The underlying activity continues and the likelihood of the event is generally unchanged, so this is not avoidance or reduction.

Question 36Fundamentals of Risk Management and Risk Assessment

An organization defines its risk capacity as the maximum risk it can bear before breaching regulatory capital requirements. How does risk appetite relate to that capacity?

  1. Appetite is identical to capacity and must always equal the regulatory maximum.
  2. Appetite is the amount of risk the organization chooses to pursue within the limits set by capacity. Correct answer.
  3. Appetite is set by regulators and capacity is set by management.
  4. Appetite applies only to financial risks, while capacity applies only to operational risks.

Explanation

Risk capacity is the outer boundary of risk the organization can absorb, often shaped by capital, liquidity, or regulatory constraints. Risk appetite is a chosen position within that boundary, reflecting strategy and willingness rather than mere ability.

Question 37Fundamentals of Risk Management and Risk Assessment

During a scenario analysis workshop, participants estimate the impact of a cyber breach by considering only direct recovery costs. Which improvement most strengthens the assessment?

  1. Reduce the scenario to a single point estimate to remove uncertainty.
  2. Exclude regulatory penalties because they are difficult to quantify.
  3. Include indirect consequences such as reputational damage, regulatory penalties, and lost business during downtime. Correct answer.
  4. Restrict the scenario to events that have already occurred in the organization's history.

Explanation

Scenario impact estimates should capture the full range of consequences, including indirect and second-order effects, because excluding them systematically understates exposure. Difficult-to-quantify items should be estimated with ranges and stated assumptions rather than omitted.

Question 38Fundamentals of Risk Management and Risk Assessment

A heat map aggregates risks by plotting likelihood against impact, and a cluster of risks appears in the high-impact, low-likelihood corner. Which analytical caution applies most directly?

  1. The heat map proves the risks are correlated and will occur simultaneously.
  2. The cluster can be ignored because low likelihood guarantees the events will not occur.
  3. Low-likelihood ratings may rest on sparse historical data and deserve stress testing for tail scenarios. Correct answer.
  4. The cluster indicates the risks have already been fully mitigated by existing controls.

Explanation

Rare events often have limited historical observations, so likelihood estimates are uncertain and may understate tail exposure. Stress testing and scenario analysis supplement the heat map by exploring severe but plausible outcomes.

Question 39Fundamentals of Risk Management and Risk Assessment

An organization uses a Monte Carlo simulation for a portfolio of risks and reports a 95th percentile aggregate loss of $12 million. Which interpretation is correct?

  1. The organization's risk capacity is exactly $12 million.
  2. The average aggregate loss across all simulated scenarios is $12 million.
  3. There is a 5% probability that aggregate losses exceed $12 million in the modeled period. Correct answer.
  4. Aggregate losses will never exceed $12 million in the modeled period.

Explanation

The 95th percentile of a simulated loss distribution is the value that losses exceed in only 5% of simulated outcomes, given the model's assumptions. It is a tail measure, not an average and not a hard maximum.

Question 40Fundamentals of Risk Management and Risk Assessment

A control is tested and found to operate as designed, but the test also shows the control addresses only part of the causal pathway that produces the risk. How should the control be characterized?

  1. Redundant, because partial coverage implies the control duplicates another control.
  2. Ineffective, because any gap in coverage means the control provides no value.
  3. Fully effective, because operating as designed is the sole criterion for control effectiveness.
  4. Effective in operation but limited in coverage, so residual risk may remain higher than the design intent assumed. Correct answer.

Explanation

Control effectiveness has two dimensions: whether the control operates as intended and whether its design adequately addresses the risk. A control can operate reliably yet leave part of the causal pathway unaddressed, which means residual risk must be reassessed rather than assumed acceptable.

Question 41Risk Identification, Analysis, and Evaluation

In the SAMRA risk process, which activity immediately follows risk identification in the standard risk management sequence?

  1. Risk monitoring
  2. Risk communication
  3. Risk treatment
  4. Risk analysis Correct answer.

Explanation

The core sequence is identification, analysis, evaluation, treatment, then monitoring and review, with communication and consultation running throughout. Analysis follows identification because identified risks must be understood before they can be compared against criteria. Treatment and monitoring occur later in the cycle.

Question 42Risk Identification, Analysis, and Evaluation

A SAMRA analyst records a risk as 'the new payment gateway may fail during peak load, causing transaction losses.' Which component of the risk statement is 'causing transaction losses'?

  1. The risk owner
  2. The consequence Correct answer.
  3. The control
  4. The likelihood

Explanation

A well-formed risk statement pairs a cause or event with its consequence. The phrase describing the effect that follows the event is the consequence. Likelihood expresses probability, controls are safeguards, and the owner is the accountable person.

Question 43Risk Identification, Analysis, and Evaluation

Which term describes the process of determining whether a risk's level is acceptable relative to the organization's risk criteria?

  1. Risk identification
  2. Risk treatment
  3. Risk appetite setting
  4. Risk evaluation Correct answer.

Explanation

Risk evaluation compares analyzed risk levels against established criteria to decide whether the risk is tolerable. Identification finds risks, treatment modifies them, and appetite setting defines the criteria in advance. Evaluation is the decision point between analysis and treatment.

Question 44Risk Identification, Analysis, and Evaluation

An analyst estimates likelihood as 'rare' and consequence as 'major' on a five-by-five matrix. What is the primary limitation of relying solely on this qualitative rating?

  1. It eliminates the need for expert judgment
  2. It requires precise actuarial loss data to be valid
  3. It can obscure differences between risks that share the same rating band Correct answer.
  4. It cannot be applied to operational risks

Explanation

Qualitative matrices collapse many distinct risks into a small number of bands, so risks with very different underlying profiles may appear identical. Matrices do not require actuarial data, apply broadly to operational risks, and still depend on judgment. The banding effect is the main analytical weakness.

Question 45Risk Identification, Analysis, and Evaluation

Which of the following best describes residual risk in the SAMRA framework?

  1. The risk remaining after existing controls are applied Correct answer.
  2. The risk that has been formally accepted by senior management
  3. The risk before any controls are considered
  4. The risk transferred to a third party through insurance

Explanation

Residual risk is what remains once current controls are taken into account, as opposed to inherent or gross risk. Acceptance is a treatment decision, and transfer is one treatment option. Residual risk reflects the effectiveness of controls already in place.

Question 46Risk Identification, Analysis, and Evaluation

A risk register entry lists a risk with no assigned owner and no review date. Which risk identification quality issue does this most directly represent?

  1. Incomplete risk documentation Correct answer.
  2. Duplication of risk entries
  3. Excessive risk aggregation
  4. Over-reliance on quantitative data

Explanation

An owner and a review date are core fields of a complete risk record. Their absence indicates incomplete documentation rather than aggregation, data over-reliance, or duplication. Complete records support accountability and timely reassessment.

Question 47Risk Identification, Analysis, and Evaluation

Which technique is specifically designed to surface risks by exploring how a system could fail at each step of a process?

  1. SWOT analysis
  2. Delphi technique
  3. Brainstorming
  4. Failure mode and effects analysis Correct answer.

Explanation

Failure mode and effects analysis systematically examines each process step for potential failure modes and their effects. Brainstorming and Delphi are general idea-generation methods, and SWOT examines strategic strengths and weaknesses. FMEA is the structured failure-focused technique.

Question 48Risk Identification, Analysis, and Evaluation

In risk analysis, what does 'likelihood' specifically measure?

  1. The financial magnitude of a risk event
  2. The time until a risk is reviewed
  3. The probability that a risk event will occur Correct answer.
  4. The number of controls applied to a risk

Explanation

Likelihood expresses the chance or probability of a risk event occurring within a defined period. Magnitude of impact is consequence, controls are safeguards, and review timing is a governance detail. Likelihood and consequence together determine risk level.

Question 49Risk Identification, Analysis, and Evaluation

A project team identifies a supplier insolvency risk and rates likelihood as medium and consequence as high. The organization's criteria state that any high-consequence risk must be escalated regardless of likelihood. What should happen next?

  1. Defer the decision until the next annual review cycle
  2. Treat the risk as acceptable because likelihood is only medium
  3. Escalate the risk for senior review because it meets the mandatory escalation criterion Correct answer.
  4. Downgrade the consequence rating so the risk stays within tolerance

Explanation

Evaluation applies the organization's criteria to the analyzed risk. Because a high-consequence rating triggers mandatory escalation irrespective of likelihood, the risk must be escalated. Adjusting ratings to avoid escalation would misrepresent the analysis, and deferral ignores the stated rule.

Question 50Risk Identification, Analysis, and Evaluation

An analyst is comparing two risks: Risk A has a 20% chance of a $500,000 loss, and Risk B has a 60% chance of a $150,000 loss. Using expected monetary value, which risk has the higher expected loss?

  1. Risk A at $100,000 Correct answer.
  2. Risk B at $90,000
  3. Risk B at $150,000
  4. Risk A at $500,000

Explanation

Expected monetary value multiplies probability by impact. Risk A is 0.20 times $500,000, equal to $100,000, while Risk B is 0.60 times $150,000, equal to $90,000. Risk A therefore has the higher expected loss even though its probability is lower.