ITPEC IP April 2025 Question 68
If risk assessment is divided into three (3) processes, which of the following is the third process besides risk identification and risk evaluation?
Explanation
Risk analysis — risk assessment consists of risk identification, risk analysis and risk evaluation (ISO 31000).
Risk management runs: establish the context, then risk assessment, then risk treatment, with monitoring and communication throughout. Risk assessment has three steps:
- Risk identification — find the risks that could affect the objectives
- Risk analysis — estimate the likelihood and consequence of each risk, which give its level
- Risk evaluation — compare the levels with the risk criteria and decide which risks need treatment and in what order
Answer (d)
Why not others:
- •(a) Risk transfer — shifting the loss to another party, for example by insurance or outsourcing, is a risk treatment option chosen after assessment
- •(b) Risk avoidance — stopping the activity that causes the risk is also risk treatment
- •(c) Risk reduction — lowering likelihood or impact with controls is also risk treatment
Key rule: Assessment finds and ranks risks (identify, analyse, evaluate); treatment decides what to do about them (avoid, reduce, transfer, accept).
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official IP past-paper collection or Report an issue.