Risk Assessment Methods CGEIT Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In quantitative risk assessment, what does the annualized loss expectancy (ALE) represent?

   • AThe maximum possible loss from a single risk event
   • BThe total cost of implementing all risk mitigation controls
   • CThe probability that a risk will occur within a year
   • DThe expected monetary loss per year due to a specific risk
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A risk assessment has produced both qualitative ratings and quantitative ALE values for a set of risks. The board is concerned that the qualitative ratings and quantitative values sometimes conflict (e.g., a risk rated 'high' qualitatively has a low ALE). How should the risk team reconcile these differences when presenting to the board?

   • AAdjust the qualitative ratings to align with the ALE values, as the quantitative data is more objective.
   • BAdjust the ALE values to align with the qualitative ratings, as the experts' judgment is more reliable.
   • CPresent only the ALE values, as they are more objective and easier to compare.
   • DPresent both perspectives and explain that qualitative ratings capture non-financial impacts that ALE does not.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary benefit of using a hybrid risk assessment approach that combines qualitative and quantitative methods?

   • AIt guarantees that all risks are accurately quantified
   • BIt leverages the strengths of both methods to provide a more comprehensive risk picture
   • CIt eliminates the need for expert judgment in the assessment
   • DIt reduces the total time required for the risk assessment to near zero
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A large healthcare organization is assessing risks related to patient data breaches. They have detailed historical data on breach frequency and cost per record, but the risk team also wants to capture the reputational impact and regulatory scrutiny that are difficult to quantify. Which approach would best balance the need for financial rigor and the need to address hard-to-quantify factors?

   • AUse only quantitative methods, such as ALE, to calculate the expected annual loss from breaches.
   • BUse only qualitative methods, such as risk matrices, to rate the likelihood and impact of breaches.
   • CUse a hybrid approach: quantitative ALE for financial impact, supplemented by qualitative scoring for reputational and regulatory factors.
   • DUse Monte Carlo simulation to model breach frequency and cost, and ignore qualitative factors as they are not measurable.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A global bank is required by regulators to quantify operational risk capital. The bank has extensive historical loss data, but the data is not perfectly clean and includes some outliers. The risk team must produce a defensible capital figure that can withstand regulatory scrutiny. They are considering using either a quantitative method (Monte Carlo simulation) or a qualitative method (expert scoring). Which approach is more appropriate, and why?

   • AUse ALE calculations, because they are simpler and easier to explain to regulators.
   • BUse a hybrid approach, combining Monte Carlo simulation with expert adjustments for data quality issues.
   • CUse expert scoring, because it can incorporate qualitative factors that quantitative models miss.
   • DUse Monte Carlo simulation, because it can model the uncertainty in loss data and produce a distribution of potential losses.
   Reveal Solution Discussion Select an answer first