Risk appetite and portfolio decisions

Review questions

Integrated summary of risk appetite and portfolio decisions

Start the decision from an observable service objective. Describe the exposure source, event and effect path instead of recording a broad threat label. Separate a verified binding obligation from a voluntary framework and an enterprise appetite boundary; leave unknown jurisdictional scope explicit until a qualified review resolves it. Turn appetite into a threshold with denominator, observation window, action and authorised owner, and test controls before accepting residual exposure. Digital scenarios connect through shared identity, supplier and data dependencies, so neither add overlapping losses nor call controls independent when they rely on the same component. After eligibility gates, compare treatments by effect, cost, timing and scarce resources. Test whether rankings survive a stress scenario and changed assumptions. A professional memo separates observations, assumptions and inference, recommends conditional action, states a serious objection and rejected alternative, and names closure evidence and a reopening trigger. A new incident or supplier change requires revisiting the old decision against its original boundary rather than assuming approval persists.

Review questions

Test your understanding with these questions. Marking and saved results are available with a free account.

Question 1Which statement is a risk rather than an assumed legal duty? An insurer can restore unavailable identity infrastructure. The enterprise must notify a regulator within a fixed time in every country. Four hundred delayed entries are four hundred proven financial losses. A sole identity provider may delay account access and transaction confirmation.
Question 2What must accompany a temporary appetite exception? A promise that an incident cannot recur. Named acceptance, exposure cap and expiry. A changed limit without approval. A vendor uptime slogan.
Question 3How should a shared dependency appear in a risk register? As a guaranteed future loss. As a causal link across objectives with control and residual exposure. As a control result copied from a sales brochure. As unrelated department labels only.
Question 4What makes a treatment portfolio feasible? Every project funded without a capacity check. Sequenced choices with costs, dependencies and explicit tests under the resource cap. Benefits counted twice when projects share a control. The lowest invoice chosen regardless of impact.
Question 5What makes the committee request actionable? A traffic-light colour only. An unqualified guarantee of safety. A list of risks without a requested choice. A decision, owner, evidence gap, condition and review date.
Question 6Which source establishes the scope of a proposed obligation? A control dashboard. An internal policy label alone. A competitor blog. Current authoritative text interpreted for entity, activity and date.
Question 7What links a contractual clause to operating evidence? A certificate unrelated to the restricted data. A signed clause with no implemented control. A verbal assurance with no period. A mapped control owner, population, test method and exception trail.
Question 8Which copy must a deletion decision consider? Only the copy on the newest server. Only the visible customer profile. No copy if access is disabled. Primary, derived, backup and supplier-held copies according to their applicable retention rules.
Question 9How can multiple small exceptions become material? They cannot because each approval was small. Combined they may grant broad access or exceed an aggregate limit. They matter only if an auditor notices them. They automatically cancel one another.
Question 10What belongs in an initial incident notice? A promise of zero impact from incomplete logs. Verified scope, uncertainty, immediate containment and next update owner. Names of suspected staff before investigation. A definitive legal conclusion without source.
Question 11What defines the criticality of a service? Only the quiet-period outage duration. Customer harm across time, dependencies and tolerance, not uptime alone. Only the number of servers. Only the supplier invoice.
Question 12What does an hourly backup leave unproven? Usable recovery time and reconciliation of intervening changes. The existence of a backup schedule. That the copy was created periodically. The timestamp of a stored copy.
Question 13Which precontract test challenges vendor concentration? Timed data export and replacement-service exercise. A comparison of logo designs. The vendor sales demo alone. A promise of perpetual availability.
Question 14What demonstrates the shared control chain worked? A contract naming several teams. One event traced from creation through receipt, linkage and accountable response. A diagram without a live test. Separate green dashboards with no matched event.
Question 15What should govern remediate versus exit? The supplier relationship length alone. Ticket volume alone. The newest sales discount. Residual critical harm, repeated test results and a safe transition path.
Question 16What is missing from a warning metric with no owner? A more attractive chart colour. A lower threshold chosen retrospectively. A response route and authority when its threshold is crossed. A larger historical sample alone.
Question 17What limits a sample-test conclusion? The actual population, selection method, period and exceptions tested. The number of slides in the report. The ambition of the assurance team. The manager signature alone.
Question 18What should an impact range disclose? Volume, per-case effect, response cost and confidence for each scenario. Only the highest imaginable loss. A single exact number with no assumptions. Only the easiest component to price.
Question 19Why does a ten-minute server video not prove recovery? Pending transactions and customer service may remain impaired. Video evidence is never usable. Only an external auditor may observe a test. Every server restart is a breach of law.
Question 20What follows discovering excluded service accounts? Correct the stated population and test the omitted accounts before a complete-control claim. Suppress the finding until next year. Retitle the report while keeping its conclusion. Assume machine accounts have no access risk.
Question 21What makes a pilot release bounded? Defined cohort, cap, stop rule and rollback responsibility. A rollback plan with no person or test. Unlimited expansion if the mean improves. A label saying pilot.
Question 22What makes human review more than a formality? The rule version is discarded. The reviewer can inspect relevant evidence and correct an outcome. The reviewer sees only a score. A customer can submit a complaint with no response route.
Question 23Why is switching off fraud checks a poor queue remedy? It may clear backlog while allowing unsafe acceptance and duplicate effects. It always violates the same law everywhere. It makes every legitimate customer fraudulent. It necessarily increases server downtime.
Question 24Which result should challenge scale-up after a faster mean refund? The number of project meetings. The faster mean itself. Concentrated second reviews or harm in a subgroup of trial customers. The fact that the pilot ended on time.