I85PREP
⌘ K
CSRM study materials
CSRM study resources

CSRM practice questions

One question at a time. Build your CSRM understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamentals of Risk Management

In enterprise risk management, what does the concept of 'risk appetite' describe?

  1. The maximum financial loss an insurer will pay on a single policy
  2. The amount and type of risk an organization is willing to accept in pursuit of its objectives Correct answer.
  3. The regulatory capital a bank must hold against credit losses
  4. The total value of assets exposed to a given hazard

Explanation

Risk appetite is the broad amount and type of risk an organization chooses to pursue or retain in order to meet its strategic objectives. It is set by senior leadership and expressed through statements and limits that guide decision-making. It is distinct from capacity, which is the maximum risk the organization could bear.

Question 2Fundamentals of Risk Management

Which statement best distinguishes risk tolerance from risk appetite?

  1. Tolerance is set only by external regulators
  2. Tolerance is the acceptable variation around appetite for a specific risk category or objective Correct answer.
  3. Tolerance applies only to operational risks
  4. Tolerance is the total capital available to absorb losses

Explanation

Risk appetite sets the overall level of risk the organization seeks, while risk tolerance defines the acceptable deviation or variation around that appetite for specific objectives or risk types. Tolerance is often expressed as quantitative thresholds or limits. Both are internally set, though they may be constrained by regulation.

Question 3Fundamentals of Risk Management

Inherent risk is best defined as which of the following?

  1. The risk transferred to a third party through insurance
  2. The risk that a control will fail to operate as designed
  3. The risk remaining after controls have been applied
  4. The risk that exists before any controls or mitigations are considered Correct answer.

Explanation

Inherent risk is the level of risk present before any controls or mitigation measures are applied. Comparing inherent risk to residual risk helps organizations judge how much risk their controls actually reduce. Residual risk is the exposure that remains after controls are in place.

Question 4Fundamentals of Risk Management

A risk register entry lists a risk with inherent score 16 and residual score 6. What does the gap between these scores most directly indicate?

  1. The controls in place are assessed as reducing the exposure substantially Correct answer.
  2. The organization has eliminated the risk entirely
  3. The risk has been transferred to an insurer
  4. The risk appetite has been exceeded

Explanation

A lower residual score relative to the inherent score indicates that the assessed controls are effective at reducing exposure. The gap quantifies the perceived risk reduction from existing controls. It does not mean the risk is eliminated, since residual risk remains.

Question 5Fundamentals of Risk Management

Which of the following is the clearest example of risk avoidance as a treatment option?

  1. Accepting a small fraud loss within budget
  2. Deciding not to enter a market where political instability is severe Correct answer.
  3. Installing a sprinkler system to reduce fire loss
  4. Purchasing insurance against flood damage

Explanation

Avoidance means not undertaking the activity that gives rise to the risk, thereby removing the exposure. Declining to enter an unstable market eliminates the associated political risk. Insurance is transfer, sprinklers are mitigation, and accepting losses is retention.

Question 6Fundamentals of Risk Management

An organization buys a cyber insurance policy. Which risk treatment option does this represent?

  1. Risk transfer Correct answer.
  2. Risk avoidance
  3. Risk retention
  4. Risk reduction through mitigation

Explanation

Purchasing insurance transfers a defined portion of the financial consequences of a risk to the insurer in exchange for a premium. The underlying risk still exists, but the financial burden is shared. This is the classic example of risk transfer.

Question 7Fundamentals of Risk Management

Which of the following best describes residual risk?

  1. The maximum risk an organization can financially absorb
  2. The risk that remains after controls and treatment actions have been applied Correct answer.
  3. The risk that a single control will malfunction
  4. The risk before any controls are considered

Explanation

Residual risk is the exposure that remains once controls and treatment measures are in place. It is the level management must decide whether to accept or address further. It is contrasted with inherent risk, which is measured before controls.

Question 8Fundamentals of Risk Management

What is the primary purpose of a risk heat map in enterprise risk management?

  1. To document the accounting treatment of contingent liabilities
  2. To record the names of employees responsible for each control
  3. To calculate the exact probability of each identified risk event
  4. To visually prioritize risks by plotting likelihood against impact Correct answer.

Explanation

A heat map plots risks on a grid of likelihood and impact, often color-coded, so decision-makers can quickly see which risks are most significant. It supports prioritization and communication rather than precise probability calculation. It is a qualitative or semi-quantitative tool.

Question 9Fundamentals of Risk Management

A risk is assessed as having high likelihood and high impact. According to typical risk prioritization logic, how should management treat it?

  1. It should be deprioritized because it is too costly to address
  2. It should be retained without further action
  3. It should be addressed with priority using mitigation, transfer, or avoidance Correct answer.
  4. It should be removed from the register as unmanageable

Explanation

Risks with high likelihood and high impact sit in the most severe zone of a risk matrix and warrant priority treatment. Management should apply one or more treatment options such as mitigation, transfer, or avoidance. Deprioritizing or ignoring such risks increases exposure unnecessarily.

Question 10Fundamentals of Risk Management

Which of the following best captures the difference between a risk and an issue?

  1. A risk is a potential future event, while an issue is a problem that has already occurred Correct answer.
  2. A risk is always external, while an issue is always internal
  3. A risk is a certain future loss, while an issue is an uncertain one
  4. A risk only concerns financial matters, while an issue concerns operations

Explanation

A risk is an uncertain event that may occur in the future and affect objectives, whereas an issue is a problem that has already materialized and requires management. Issue logs and risk registers are therefore kept separately. Confusing the two can lead to poor prioritization.

Question 11Fundamentals of Risk Management

In the context of risk management, what does 'risk capacity' mean?

  1. The maximum amount of risk an organization can bear before it breaches its objectives or viability Correct answer.
  2. The amount of risk management budget allocated for the year
  3. The frequency with which risks are reviewed
  4. The number of risks recorded in the register

Explanation

Risk capacity is the maximum level of risk an organization can absorb while still meeting obligations and remaining viable. Appetite should be set at or below capacity. Capacity is often constrained by capital, liquidity, and regulatory requirements.

Question 12Fundamentals of Risk Management

A board sets risk appetite limits, and a business unit proposes a transaction that exceeds those limits. What is the most appropriate governance response?

  1. Escalate to the appropriate authority for a decision, since the proposal breaches appetite Correct answer.
  2. Silently adjust the limits to accommodate the transaction
  3. Ignore the breach because appetite is only advisory
  4. Approve the transaction because business units have final authority

Explanation

When a proposed activity breaches established appetite limits, it should be escalated to the body with authority to decide, such as the board or risk committee. Appetite limits are a governance control that constrains risk-taking. Unilateral adjustment or ignoring the breach undermines the framework.

Question 13Fundamentals of Risk Management

Which trio represents the classic three lines of defense model in risk governance?

  1. Internal audit, external audit, and the board
  2. Front office, back office, and clearing
  3. Operational management, a risk and compliance function, and internal audit Correct answer.
  4. Shareholders, regulators, and auditors

Explanation

The three lines of defense model places operational management as the first line owning risk, an independent risk and compliance function as the second line providing oversight, and internal audit as the third line giving independent assurance. This separation clarifies accountability and independence. External audit is not part of the internal model.

Question 14Fundamentals of Risk Management

What is the primary role of the second line of defense in a three-lines model?

  1. To provide independent assurance to the board on controls
  2. To conduct the external financial statement audit
  3. To set risk frameworks and provide oversight and challenge to the first line Correct answer.
  4. To own and manage risks in day-to-day operations

Explanation

The second line develops risk frameworks, policies, and monitoring, and provides oversight and challenge to the first line's risk-taking. It does not own operational risks, which belong to the first line. Independent assurance is the role of internal audit, the third line.

Question 15Fundamentals of Risk Management

Which of the following is an example of a key risk indicator (KRI)?

  1. The number of customer complaints received per month Correct answer.
  2. The market share held by a competitor
  3. The organization's annual revenue growth rate
  4. The total number of employees on payroll

Explanation

A key risk indicator is a metric that provides early warning of increasing risk exposure. A rising count of customer complaints can signal deteriorating operational or conduct risk. Revenue growth, headcount, and competitor share are performance or market metrics, not direct risk indicators.

Question 16Fundamentals of Risk Management

What does a 'risk-based approach' primarily mean in the context of allocating risk management effort?

  1. Reviewing risks only when an incident occurs
  2. Focusing only on risks that are easy to measure
  3. Directing resources toward risks in proportion to their assessed significance Correct answer.
  4. Applying identical controls to every risk regardless of severity

Explanation

A risk-based approach allocates effort and controls in proportion to the assessed likelihood and impact of risks. Higher-significance risks receive more attention and stronger controls. This is more efficient than uniform treatment or reacting only to incidents.

Question 17Fundamentals of Risk Management

Which of the following best describes a control's 'design effectiveness' versus its 'operating effectiveness'?

  1. Design effectiveness concerns cost; operating effectiveness concerns speed
  2. Design effectiveness concerns whether the control is properly built; operating effectiveness concerns whether it works consistently in practice Correct answer.
  3. Design effectiveness concerns external audit; operating effectiveness concerns internal audit
  4. Design effectiveness concerns residual risk; operating effectiveness concerns inherent risk

Explanation

Design effectiveness asks whether a control, as designed, would adequately address the risk if operated properly. Operating effectiveness asks whether the control actually functions consistently over time. Both must be assessed; a well-designed control can still fail in operation.

Question 18Fundamentals of Risk Management

In risk assessment, what does 'likelihood' refer to?

  1. The total cost of the controls applied
  2. The regulatory penalty for a compliance failure
  3. The probability or frequency that a risk event will occur Correct answer.
  4. The financial value of the assets at risk

Explanation

Likelihood expresses the probability or expected frequency of a risk event occurring within a given period. It is combined with impact to derive an overall risk rating. It is distinct from impact, which concerns the consequence if the event happens.

Question 19Fundamentals of Risk Management

A risk matrix uses a 5x5 grid of likelihood and impact. A risk scored likelihood 4 and impact 5 would typically be classified as which of the following?

  1. High or critical risk requiring priority treatment Correct answer.
  2. Low risk requiring no action
  3. A risk outside the scope of the framework
  4. Moderate risk monitored periodically

Explanation

On a 5x5 matrix, near-maximum likelihood combined with maximum impact falls in the highest band, typically classified as high or critical. Such risks require priority treatment and escalation. Lower bands correspond to combinations with lower likelihood or impact.

Question 20Fundamentals of Risk Management

Which of the following best describes the purpose of risk reporting to senior management and the board?

  1. To replace the need for internal controls
  2. To provide timely, relevant information on risk exposures and trends to support informed decisions Correct answer.
  3. To satisfy a one-time regulatory filing requirement
  4. To assign blame for past failures

Explanation

Risk reporting gives decision-makers timely and relevant information about exposures, concentrations, and trends so they can govern effectively. It is an ongoing process rather than a one-off filing. It complements, rather than replaces, internal controls.

Question 21Fundamentals of Risk Management

An organization identifies a risk that is within its appetite and decides to take no further action. Which treatment option does this represent?

  1. Risk transfer
  2. Risk avoidance
  3. Risk retention (acceptance) Correct answer.
  4. Risk elimination

Explanation

Accepting a risk that falls within appetite without further action is risk retention or acceptance. It is a deliberate, informed decision rather than neglect. It differs from transfer, avoidance, and reduction, which actively change the exposure.

Question 22Fundamentals of Risk Management

Which of the following best describes the relationship between risk management and organizational strategy?

  1. Risk management should only be performed after strategy is fully executed
  2. Risk management replaces strategic planning
  3. Risk management informs strategy by identifying threats and opportunities that affect objectives Correct answer.
  4. Risk management is a standalone compliance exercise unrelated to strategy

Explanation

Effective risk management is integrated with strategy, helping the organization understand threats and opportunities that could affect its objectives. It informs strategic choices rather than operating in isolation. It does not replace strategic planning, nor is it confined to post-execution review.

Question 23Fundamentals of Risk Management

What is the primary benefit of maintaining a risk register?

  1. It provides a structured record of identified risks, owners, ratings, and treatments to support monitoring Correct answer.
  2. It replaces the need for board oversight
  3. It calculates the organization's tax liability
  4. It guarantees that no risks will materialize

Explanation

A risk register is a structured tool that records identified risks along with their owners, assessments, controls, and treatment plans. It supports ongoing monitoring and accountability. It does not prevent risks from occurring or substitute for governance.

Question 24Fundamentals of Risk Management

An organization faces a risk with low likelihood but catastrophic impact, such as a major natural disaster. Which treatment consideration is most appropriate?

  1. Remove it from the register to reduce reported risk
  2. Retain it without any planning because it is unlikely
  3. Ignore it because the likelihood is low
  4. Consider transfer through insurance and business continuity planning given the severe impact Correct answer.

Explanation

Low-likelihood, high-impact risks warrant attention because the consequences can be severe or existential. Transfer through insurance and continuity planning can reduce financial and operational impact. Dismissing them because they are unlikely leaves the organization exposed.

Question 25Fundamentals of Risk Management

Which of the following best describes 'risk culture' within an organization?

  1. The software used to record risk data
  2. The written set of risk policies approved by the board
  3. The shared values, attitudes, and behaviors that shape how risks are identified and managed Correct answer.
  4. The number of risk committee meetings held each year

Explanation

Risk culture refers to the shared values, attitudes, and behaviors that determine how people identify, discuss, and manage risk in practice. Written policies and meeting counts are artifacts or indicators, not culture itself. A strong culture encourages open escalation of concerns.

Question 26Fundamentals of Risk Management

An analyst records a risk as 'inherent' before considering any controls. Which statement correctly describes inherent risk?

  1. The exposure that remains after existing controls have been applied and tested
  2. The maximum loss an organization could survive without breaching capital requirements
  3. The portion of a risk that has been transferred to a third party through contract
  4. The exposure that exists before any mitigating controls are applied Correct answer.

Explanation

Inherent risk is the gross exposure of an activity before any controls or mitigations are considered. It provides the baseline against which the effect of controls, and therefore residual risk, can be measured. Comparing inherent and residual risk shows how much protection current controls actually deliver.

Question 27Fundamentals of Risk Management

A risk practitioner is distinguishing between a hazard, a risk, and an opportunity. Which characterization is most consistent with standard risk management terminology?

  1. A hazard is a source of potential harm, while a risk is the effect of uncertainty on objectives Correct answer.
  2. A hazard and a risk are synonyms, both describing a realized loss event
  3. A risk always implies a downside, while a hazard describes only upside potential
  4. An opportunity is any hazard that has been fully controlled and closed

Explanation

In ISO-style terminology a hazard or risk source is something with the potential to cause harm, whereas risk is the effect of uncertainty on objectives and can be positive or negative. Keeping these concepts distinct prevents confusion between the cause and its consequences. Opportunities are the positive side of risk, not closed hazards.

Question 28Fundamentals of Risk Management

An organization decides to stop offering a product line because the associated risks exceed its appetite. Which risk treatment option has been applied?

  1. Risk modification
  2. Risk avoidance Correct answer.
  3. Risk retention
  4. Risk transfer

Explanation

Avoidance means exiting the activity that gives rise to the risk entirely, so the exposure no longer exists. Withdrawing a product line removes the underlying source of loss rather than sharing or reducing it. Retention, transfer, and modification all keep the activity running in some form.

Question 29Fundamentals of Risk Management

A manager argues that because a risk has been assessed as low, no monitoring is required. Which principle best rebuts this argument?

  1. Low-rated risks never change and therefore need no oversight
  2. Only financial risks require monitoring once they are rated low
  3. Risk profiles shift over time, so accepted risks still require periodic monitoring Correct answer.
  4. Monitoring is the responsibility of external auditors rather than management

Explanation

Risk ratings are snapshots; changes in environment, controls, or strategy can move a low risk into a higher band. Ongoing monitoring and review is therefore a core part of the risk management process for accepted risks as well as active ones. Treating a low rating as permanent removes the feedback loop that keeps assessments current.

Question 30Fundamentals of Risk Management

Which statement best distinguishes risk appetite from risk tolerance?

  1. Appetite is the amount of risk an organization is willing to pursue for reward, while tolerance is the acceptable variation around that level Correct answer.
  2. Appetite applies only to financial risk, while tolerance applies to operational risk
  3. Appetite and tolerance are interchangeable terms with identical meaning
  4. Appetite is set by regulators, while tolerance is set by individual business units

Explanation

Risk appetite expresses the amount and type of risk an organization is willing to accept in pursuit of objectives. Tolerance, sometimes called risk tolerance or acceptable variation, defines the boundaries of deviation that can be absorbed around that appetite. Appetite is strategic and forward-looking, while tolerance sets practical limits.

Question 31Fundamentals of Risk Management

A firm maps its processes to identify where failures could occur and then assesses the consequences of each failure. Which technique is being used?

  1. Benchmarking against peer institutions
  2. Capital adequacy stress testing
  3. Scenario analysis of macroeconomic shocks
  4. A bottom-up process-level risk and control assessment Correct answer.

Explanation

Mapping processes and evaluating failure points and their consequences is a process-level risk and control assessment, often called a risk and control self-assessment when performed by process owners. It builds an inventory of operational risks tied to specific activities. Macroeconomic scenarios, capital stress tests, and peer benchmarking operate at different levels.

Question 32Fundamentals of Risk Management

Which of the following is the best example of an internal risk driver rather than an external one?

  1. A revision to data protection legislation
  2. A change in interest rates announced by the central bank
  3. High staff turnover in a critical control function Correct answer.
  4. A new competitor entering the organization's core market

Explanation

Internal risk drivers originate inside the organization and are largely within its influence, such as staffing, culture, systems, and process design. High turnover in a control function is an internal driver that can raise error and fraud risk. Interest rates, competition, and legislation are external drivers outside management's direct control.

Question 33Fundamentals of Risk Management

A risk owner records a risk event that has already occurred and is now consuming resources. How should this be classified?

  1. A key risk indicator, because it signals future exposure
  2. A control weakness, because it was not prevented
  3. An issue, because the event has materialized and requires management action Correct answer.
  4. A risk, because it still has uncertain future consequences

Explanation

Once an event has materialized it is an issue rather than a risk, because the uncertainty about occurrence has been resolved. Issues are managed through remediation and incident processes, while risks are managed prospectively. The same underlying cause may generate both an issue and a forward-looking risk entry.

Question 34Fundamentals of Risk Management

A risk assessment team estimates impact using a defined scale where level 3 corresponds to a loss between defined monetary bands. What is the main benefit of this approach?

  1. It provides consistent, comparable ratings across different risks and business units Correct answer.
  2. It guarantees that no loss will exceed the estimated amount
  3. It automatically transfers losses above the band to an insurer
  4. It removes the need for management judgement in assessing risk

Explanation

Defined scales with calibrated bands give assessors a common language, so ratings for different risks and units can be aggregated and compared. Consistency supports prioritization and reporting across the enterprise. The scale does not prevent losses, eliminate judgement, or arrange insurance.

Question 35Fundamentals of Risk Management

Which statement best describes the purpose of a risk owner in a risk management framework?

  1. To independently audit the effectiveness of controls across the organization
  2. To set the organization's overall risk appetite on behalf of the board
  3. To maintain the enterprise risk register as a central administrator
  4. To hold accountability for managing a specific risk and its response within delegated authority Correct answer.

Explanation

A risk owner is accountable for a defined risk, including monitoring it and ensuring the agreed response is implemented and effective. Ownership sits with the business, within delegated authority, rather than with audit or a central administrator. Appetite setting remains a governing body responsibility.

Question 36Fundamentals of Risk Management

A team uses a bow-tie diagram to analyze a significant operational risk. Which elements does this technique explicitly connect?

  1. Likelihood and impact scores on a single matrix cell
  2. Risk appetite, tolerance, and capacity limits
  3. Key risk indicators and key performance indicators over time
  4. Threats and consequences, linked through a top event with preventive and mitigating controls Correct answer.

Explanation

A bow-tie diagram places a top event at the centre, with threats and preventive controls on the left and consequences and mitigating controls on the right. This makes visible both the causes that could trigger the event and the controls that limit prevention and recovery. It is a causal mapping tool rather than a scoring or appetite device.

Question 37Fundamentals of Risk Management

Which of the following best explains why an organization should document its risk criteria before assessing individual risks?

  1. It guarantees that all identified risks fall within appetite
  2. It removes the need to consult subject matter experts during assessment
  3. It sets agreed thresholds and scales so that assessments are consistent and decisions are defensible Correct answer.
  4. It ensures every risk receives the same rating regardless of context

Explanation

Risk criteria define the scales, thresholds, and significance tests used to evaluate risks, which makes assessments comparable and decisions explainable. Agreeing them in advance reduces bias and inconsistency between assessors. Criteria do not force identical ratings, replace expertise, or guarantee appetite compliance.

Question 38Fundamentals of Risk Management

An organization applies the precautionary principle when facing a risk with high scientific uncertainty and potentially irreversible harm. What does this imply for decision-making?

  1. Preventive action may be justified even before full evidence of harm is established Correct answer.
  2. Action should be deferred until uncertainty is fully eliminated
  3. The risk should be ignored because it cannot be quantified reliably
  4. The risk must always be transferred to an insurer before any activity proceeds

Explanation

The precautionary principle holds that where there is credible threat of serious or irreversible harm, lack of full certainty should not delay proportionate preventive measures. It shifts the burden of proof toward demonstrating safety rather than waiting for conclusive evidence. It does not require eliminating all uncertainty or mandate a specific treatment such as insurance.

Question 39Fundamentals of Risk Management

Which of the following best describes the role of a risk taxonomy in an enterprise risk management framework?

  1. It ranks individual risks by their calculated financial value at risk
  2. It defines the maximum loss the organization is willing to accept
  3. It provides a structured classification of risk types so that exposures can be consistently identified, aggregated, and reported Correct answer.
  4. It replaces the risk register by storing all risk events in a single list

Explanation

A risk taxonomy groups risks into a defined hierarchy of categories and subcategories, giving a common language for identification and aggregation. Consistent classification allows exposures to be rolled up and compared across the enterprise. It is a structuring tool, not a valuation, register, or appetite statement.

Question 40Fundamentals of Risk Management

A firm identifies a risk whose likelihood is low but whose impact would be severe and irreversible. It buys insurance and also builds a backup facility. Which statement best evaluates this response?

  1. The response is flawed because a single risk may only be treated in one way
  2. The response combines transfer and modification, which can be appropriate when residual exposure remains unacceptable Correct answer.
  3. The response is unnecessary because low-likelihood risks should always be retained
  4. The response is ineffective because insurance eliminates the need for any physical controls

Explanation

Risk treatment options are not mutually exclusive; combining transfer with modification can reduce both financial and operational consequences. When impact would be severe and irreversible, layering controls is often proportionate even at low likelihood. Insurance alone leaves continuity exposure, so a backup facility addresses a different dimension of the risk.

Question 41Measuring School Risks

A school safety team wants a single summary number that expresses how many students were involved in a given type of incident per 100 enrolled students during the year. Which measure best matches that goal?

  1. A raw count of incident reports
  2. A ratio of incidents to staff members
  3. An incident rate per 100 students Correct answer.
  4. A trend line of monthly report totals

Explanation

A rate per 100 students standardizes incident counts against enrollment, so schools of different sizes can be compared. Raw counts and staff-based ratios do not express student-level exposure in the requested unit.

Question 42Measuring School Risks

A district defines a risk indicator as the percentage of students who report feeling unsafe at school. What type of data does this indicator produce?

  1. Quantitative continuous data
  2. Categorical ordinal data Correct answer.
  3. Categorical nominal data
  4. Quantitative discrete data

Explanation

Survey responses such as safety ratings are ordered categories, which makes them ordinal. They are not measured on a continuous numeric scale, and the categories have a meaningful order, so nominal does not fit.

Question 43Measuring School Risks

A school records the number of bullying reports filed each month across four consecutive semesters. Which display is most appropriate for showing how the monthly count changes over that period?

  1. A line graph of monthly counts Correct answer.
  2. A histogram of report categories
  3. A two-way table of grade by gender
  4. A pie chart of the four semesters

Explanation

A line graph is suited to time-series data because it shows change across ordered time points. Pie charts and histograms do not display temporal progression clearly.

Question 44Measuring School Risks

A risk register lists each identified school hazard with a likelihood rating and a consequence rating, then multiplies them to rank hazards. What does this practice primarily produce?

  1. A compliance audit trail
  2. An enrollment projection
  3. A staff satisfaction index
  4. A prioritized risk score Correct answer.

Explanation

Multiplying likelihood by consequence is a standard way to generate a risk score that ranks hazards for attention. The product is a prioritization tool, not an audit record or a demographic estimate.

Question 45Measuring School Risks

A school wants to compare its rate of physical fights per 1,000 students with the state average, but its enrollment is 400 while the state figure is based on much larger schools. Which adjustment best supports a fair comparison?

  1. Compare only the months with the highest counts
  2. Convert the local count to a rate per 1,000 students Correct answer.
  3. Use the total fights across all years combined
  4. Report the raw number of fights

Explanation

Converting to a common rate per 1,000 students removes the effect of enrollment size, enabling comparison with the state figure. Raw counts and peak-month comparisons confound size and timing with risk.

Question 46Measuring School Risks

A safety survey is administered to students in a single advanced placement class because it is convenient. The resulting estimate of schoolwide safety perceptions is most vulnerable to which problem?

  1. Response-set bias
  2. Sampling bias Correct answer.
  3. Social desirability bias
  4. Recall bias

Explanation

A convenience sample drawn from one class is not representative of the whole school, which is the defining feature of sampling bias. The other biases concern how individuals answer, not who is selected.

Question 47Measuring School Risks

A district wants to know whether a new anti-bullying program reduced reported incidents. Which design provides the strongest evidence of a causal effect?

  1. A comparison of schools randomly assigned to program or control Correct answer.
  2. A review of incident reports from the year before the program
  3. Anecdotal reports from teachers who volunteered to pilot the program
  4. A single post-program survey of all students

Explanation

Random assignment to program and control groups supports causal inference by balancing confounding factors across groups. Pre/post-only and anecdotal designs cannot rule out alternative explanations.

Question 48Measuring School Risks

A risk assessment team calculates that a particular hazard has a 5% chance of occurring in a year and would affect 200 students. What does the expected number of affected students represent?

  1. The maximum possible number affected
  2. The number affected in the worst-case scenario
  3. The probability-weighted average number affected Correct answer.
  4. The number affected if the hazard never occurs

Explanation

Multiplying probability by the affected population yields an expected value, which is the long-run average across repeated scenarios. It is neither a maximum nor a worst case.

Question 49Measuring School Risks

A school's incident data show that 60% of reported fights occur in the cafeteria, which occupies 15% of the school's supervised space. What does this pattern most directly suggest for risk measurement?

  1. Cafeteria incidents should be excluded as outliers
  2. Fights are randomly distributed across the school
  3. Cafeteria supervision warrants closer analysis Correct answer.
  4. Space allocation has no relationship to incidents

Explanation

A location with a disproportionate share of incidents relative to its space is a signal for targeted risk analysis and supervision review. Excluding the data or assuming randomness ignores the observed concentration.

Question 50Measuring School Risks

A school safety index combines three indicators: bullying rate, fight rate, and weapon-report rate, each converted to a common scale before averaging. Why is scaling each indicator before averaging important?

  1. It guarantees the index is normally distributed
  2. It eliminates measurement error in each indicator
  3. It removes the need for a data dictionary
  4. It prevents one indicator with a larger numeric range from dominating the index Correct answer.

Explanation

Indicators measured on different scales can dominate a composite if averaged raw. Rescaling to a common scale ensures each contributes comparably.