IPA IP 2021 Question 91
A question IPA Japan published in 令和3年度 ITパスポート試験 公開問題 問91, translated into English. ITPEC is based on the same exams.
Among the tasks A through D below, which of the following is the list that contains all and only the tasks that are included in risk assessment in risk management?
Explanation
Identifying risks, determining their level and deciding their priority — risk assessment is the three steps of identification, analysis and evaluation; deciding how to respond comes after it.
In risk management (ISO 31000, and ISO/IEC 27005 for information security) risk assessment is followed by risk treatment:
- •Risk identification — finding the factors that can become risks: task B
- •Risk analysis — working out each risk's level from threats, vulnerabilities, likelihood and impact: task A
- •Risk evaluation — comparing the levels with the acceptance criteria and deciding which risks to respond to first: task D
- •Risk treatment — choosing how to respond, by avoidance, mitigation, transfer or retention: task C, outside the assessment
So the assessment contains A, B and D.
Answer (b)
Why not others:
- •(a) — leaves out D: setting the priority of risks is risk evaluation, the last step of the assessment
- •(c) — leaves out B, the identification that starts the assessment, and adds C, which is risk treatment
- •(d) — keeps D but drops identification and analysis, and adds C, the treatment step
Key rule: Risk assessment = identification → analysis → evaluation (which risks, how big, which first); deciding the response is risk treatment, the next stage.
Security · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.