Risk Assessment CRAGE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Why is documentation of risk assessment findings important?

   • AIt provides a record of decisions and supports accountability and transparency
   • BIt is required by all international standards
   • CIt replaces the need for ongoing risk monitoring
   • DIt guarantees that risks will be eliminated
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   An insurance company is assessing risks from an AI underwriting model. The company has limited historical data for a new product line. The risk team must decide between qualitative and quantitative analysis. What is the best approach?

   • AUse quantitative analysis with assumptions from similar products.
   • BUse both qualitative and quantitative methods in parallel.
   • CUse qualitative analysis because historical data is insufficient for reliable quantitative estimates.
   • DSkip analysis and rely on expert opinion.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A company has completed a risk assessment for its AI supply chain and identified a high-risk issue with a critical vendor. The company's board of directors needs to decide on a risk treatment. The risk team has prepared a detailed report. What is the most effective way to communicate the findings to the board?

   • AShare the full technical report with all data and analysis.
   • BProvide a concise executive summary with key risks, recommended treatments, and resource implications.
   • CPresent only the recommended treatment without discussing alternatives.
   • DCommunicate the risks verbally without written documentation.
   Reveal Solution Discussion Select an answer first
5. 29application · medium · select all that apply

   A company has completed a risk assessment for its AI supply chain. The assessment identified several risks and recommended treatments. The company needs to document and communicate the findings. Select all that apply. Which of the following are appropriate documentation and communication practices?

   • AMaintain a risk register with risk descriptions, likelihood, impact, and treatment plans.
   • BShare the full risk assessment report with all employees.
   • CProvide an executive summary to senior management.
   • DKeep the risk assessment confidential to avoid legal exposure.
   • ECommunicate risk treatment decisions to the relevant vendor.
   Check answers Discussion Select an answer first
6. 30application · medium

   A retail company has completed a risk assessment for its AI-powered demand forecasting system, which relies on a third-party data provider. The assessment identified a high-risk issue: the data provider may not comply with new data protection regulations. The company needs to decide on a risk treatment. What should the company do to support informed decision-making?

   • AAsk the data provider to self-assess and report compliance without internal review.
   • BImmediately terminate the data provider contract without further analysis.
   • CKeep the risk confidential to avoid alarming stakeholders.
   • DDocument the risk and communicate it to the procurement and legal teams with a recommended treatment option.
   Reveal Solution Discussion Select an answer first