ARM - Associate in Risk Management Risk Treatment and Mitigation Questions and Answers — Questions and Answers
Question 1: A pharmaceutical company ceases all development of a promising new drug after clinical trials reveal it causes severe, life-threatening side effects in a small percentage of the trial population. This decision to completely halt the project is a clear example of which risk treatment technique?
- Risk Modification
- Risk Transfer
- Risk Avoidance (Correct answer)
- Risk Retention
Correct answer: Risk Avoidance
Risk avoidance is a risk treatment strategy that involves deciding not to start or continue with the activity that gives rise to the risk. By abandoning the drug development project, the company is eliminating the possibility of any future losses from the identified side effects.
Question 2: After installing a state-of-the-art fire suppression system and conducting mandatory employee fire safety training, a risk manager evaluates the likelihood and impact of a potential fire at the facility. The level of risk that remains after these control measures have been implemented is known as:
- Inherent Risk
- Residual Risk (Correct answer)
- Speculative Risk
- Secondary Risk
Correct answer: Residual Risk
Residual risk is the amount of risk left over after risk treatment measures, such as controls, have been put in place. Inherent risk is the level of risk before any controls are applied.
Question 3: A data processing company is concerned about a localized power outage disrupting its operations. To mitigate this risk, it establishes a fully operational, mirrored data center in a different city on a separate power grid. This strategy of maintaining backup facilities or assets is best described as:
- Diversification
- Contractual Transfer
- Loss Prevention
- Duplication (Correct answer)
Correct answer: Duplication
Duplication is a risk control technique that involves creating redundant assets, such as spare parts, supplies, or backup facilities, to be used if the primary asset or facility is damaged or destroyed. Diversification, in contrast, involves spreading risk across different activities or markets rather than creating a backup of the same activity.
Question 4: When evaluating a potential risk control measure, a risk manager performs a cost-benefit analysis. Which of the following is the primary goal of this analysis in the context of risk treatment?
- To ensure the financial cost of implementing the control is justified by the expected reduction in losses. (Correct answer)
- To select the control that eliminates all possible risk, regardless of its cost.
- To transfer the maximum amount of financial risk to a third-party insurer.
- To prioritize controls that are mandated by industry regulations over all other factors.
Correct answer: To ensure the financial cost of implementing the control is justified by the expected reduction in losses.
The core principle of a cost-benefit analysis for risk controls is to determine if the investment is economically sensible. The goal is to ensure that the resources expended on the control are less than or equal to the financial benefit gained from the reduction in risk.
Question 5: A manufacturing plant identifies a risk of worker hearing loss from an excessively noisy machine. The first and most effective solution they implement is to replace the old machine entirely with a new, much quieter model. According to the hierarchy of controls, this action is an example of which type of control?
- Personal Protective Equipment (PPE)
- Engineering Control
- Substitution (Correct answer)
- Administrative Control
Correct answer: Substitution
The hierarchy of controls ranks risk treatments from most to least effective. Substitution involves replacing a hazardous process, material, or piece of equipment with a less hazardous one. Replacing the noisy machine with a quieter model is a direct substitution. An engineering control would modify the existing machine (e.g., add a sound-proof enclosure), while an administrative control would change how people work around it.
Question 6: An organization, after identifying and analyzing the risk of minor, frequent inventory damage, makes a conscious and planned decision to not purchase insurance for this exposure. Instead, it allocates funds in its budget to cover these expected losses as they occur. This form of risk retention is known as:
- Active Retention (Correct answer)
- Passive Retention
- Risk Deferral
- Loss Prevention
Correct answer: Active Retention
Active risk retention is a planned, deliberate decision to assume the financial consequences of a particular risk. This is in contrast to passive retention, where an organization retains a risk unknowingly, often because the risk was never identified.
