Risk Assessment CRAGE Practice Questions (Page 10)

Questions 46–48

1. 46expert · hard · select all that apply

   An organization has completed a risk assessment for its AI supply chain. The risk register includes risks with different severity levels. The organization needs to communicate the findings to various stakeholders. Which of the following are effective communication practices? Select all that apply.

   • AHold a workshop with the IT team to discuss technical risk details.
   • BShare the full risk register with all employees.
   • CPublish the risk assessment on the company's public website.
   • DProvide the board with a high-level summary of top risks and recommended actions.
   Check answers Discussion Select an answer first
2. 47application · medium

   A healthcare organization is assessing risks from an AI diagnostic tool provided by a vendor. The organization identifies two risks: (1) the model may produce false negatives for a rare disease, and (2) the vendor may fail to update the model with new medical guidelines. The organization has limited resources for risk analysis. Which approach best prioritizes these risks?

   • AQualitative analysis using a risk matrix that scores likelihood and impact for each risk.
   • BTreat both risks equally without analysis because they both involve patient safety.
   • CIgnore the vendor update risk because it is operational, not AI-specific.
   • DQuantitative analysis using Monte Carlo simulations for both risks.
   Reveal Solution Discussion Select an answer first
3. 48foundation · easy

   What is the purpose of periodic review in risk management?

   • ATo assign blame for risk management failures
   • BTo identify new risks for the first time
   • CTo eliminate all risks from the supply chain
   • DTo assess whether the risk management process remains effective and relevant
   Reveal Solution Discussion Select an answer first