Risk Management and Decision Making
What the exam tests
Risk Management and Decision Making tests enterprise risk management, risk assessment, mitigation, business continuity, and structured decision making under uncertainty. Expect questions on likelihood and impact, risk registers, insurance, and cognitive bias.
Core rules and concepts
- Enterprise risk management identifies risks across departments, not just insurable hazards.
- Assess likelihood and impact; rank risks and assign an owner and treatment.
- Treatment options: avoid, reduce, transfer through insurance or contract, or accept with monitoring.
- Business continuity planning identifies essential services, dependencies, and recovery time objectives.
- Decision quality depends on framing, alternatives, information, values, and commitment.
- Use cost-benefit, expected value, and pre-mortems; beware anchoring, confirmation bias, and groupthink.
Worked example
A city's utility faces ransomware risk. The risk register rates likelihood high and impact severe. Treatment package: reduce through multi-factor authentication, segmentation, and offline backups; transfer through cyber insurance; accept residual risk with a tested continuity plan. Reasoning: no single control eliminates risk, and insurance alone does not restore service. The pre-mortem asks what would make recovery fail, revealing that the backup restoration had never been tested.
Traps that cost marks
- Building a risk register with no owners or review cycle.
- Ignoring low-probability, high-impact events.
- Choosing the first acceptable option instead of comparing alternatives.
- Treating insurance as a substitute for controls.
- Letting groupthink suppress dissenting risk views.