Explanation: Access control helps an organization implement effective access control. They ensure that users have the rights and permissions they need to perform their jobs, and no more. It includes principles such as least privilege and separation of duties.
Incorrect Answers:
A: System and Communications protection control is a large group of controls that cover many aspects of protecting systems and communication channels. Denial of service protection and boundary protection controls are included. Transmission integrity and confidentiality controls are also included.
B: Audit and Accountability control helps an organization implement an effective audit program. It provides details on how to determine what to audit. It provides details on how to protect the audit logs. It also includes information on using audit logs for non-repudiation.
D: Identification and Authentication control cover different practices to identify and authenticate users. Each user should be uniquely identified. In other words, each user has one account. This account is only used by one user. Similarly, device identifiers uniquely identify devices on the network.

Explanation: The inherent risk of a process is a given and cannot be affected by risk reduction or risk mitigation efforts. Hence it should be reduced as far as possible.
Incorrect Answers:
A: Risk reduction efforts can focus on either avoiding the frequency of the risk or reducing the impact of a risk.
C: Risk reduction efforts can focus on either avoiding the frequency of the risk or reducing the impact of a risk.
D: The objective of risk reduction is to reduce the residual risk to levels below the enterprise’s risk tolerance level.

Explanation: Risk register is a document that contains the results of the qualitative risk analysis, quantitative risk analysis, and risk response planning. Risk register is developed along with all processes of the risk management from Plan Risk Management through Monitor and Control Risks.
Incorrect Answers:
A: The quality management plan is a component of the project management plan. It describes how the project team will implement the organization’s quality policy. The quality management plan addresses quality control (QC), quality assurance (QA), and continuous process improvement for the project. Based on the requirement of the project, the quality management plan may be formal or informal, highly detailed or broadly framed.
B: Risk management plan includes roles and responsibilities, risk analysis definitions, timing for reviews, and risk threshold. The Plan Risk Responses process takes input from risk management plan and risk register to define the risk response.
D: The project charter is the document that formally authorizes a project. The project charter provides the project manager with the authority to apply organizational resources to project activities.

Explanation:
The inputs to the plan risk management process are as follows:

• Project scope statement: It provides a clear sense of the range of possibilities associated with the project and establishes the framework for how significant the risk management effort may become.
• Cost management plan: It describes how risk budgets, contingencies, and management reserves will be reported and accessed.
• Schedule management plan: It describes how the schedule contingencies will be reported and assessed.
• Communication management plan: It describes the interactions, which occurs on the project and determines who will be available to share information on various risks and responses at different times.
• Enterprise environmental factors: It include, but are not limited to, risk attitudes and tolerances that describe the degree of risk that an organization withstand.
• Organizational process assets: It includes, but are not limited to, risk categories, risk statement formats, standard templates, roles and responsibilities, authority levels for decision-making, lessons learned, and stakeholder registers.

Incorrect Answers:
A: It is not an input for Plan risk management process.

Explanation:
Monitor and Control Risk is the process of implementing risk response plans, tracking identified risks, monitoring residual risk, identifying new risks, and evaluating risk process effectiveness throughout the project. It can involve choosing alternative strategies, executing a contingency or fallback plan, taking corrective action, and modifying the project management plan.
Incorrect Answers:
B: This is the process of numerically analyzing the effect of identified risks on overall project objectives.
C: This is the process of determining which risks may affect the project and documenting their characteristics.
D: This is the process of prioritizing risks for further analysis or action by accessing and combining their probability of occurrence and impact.

Explanation:
Risk factors are those features that influence the likelihood and/or business impact of risk scenarios. They have heavy influences on probability and impact of risk scenarios. They should be taken into account during every risk analysis, when likelihood and impact are assessed.
Incorrect Answers:
A: The enterprise must consider risk that has not yet occurred and should develop scenarios around unlikely, obscure or non-historical events.
Such scenarios can be developed by considering two things:

• Visibility
• Recognition
• [/*]
• For the fulfillment of this task enterprise must:
• [*]
• Be in a position that it can observe anything going wrong
• Have the capability to recognize an observed event as something wrong
• [/*]
• C: A risk analysis involves identifying the most probable threats to an organization and analyzing the related vulnerabilities of the organization to these threats. A risk from an organizational perspective consists of:
• [*]
• Threats to various processes of organization.
• Threats to physical and information assets.
• Likelihood and frequency of occurrence from threat.
• Impact on assets from threat and vulnerability.
• [/*]
• Risk analysis allows the auditor to do the following tasks:
• [*]
• Identify threats and vulnerabilities to the enterprise and its information system.
• Provide information for evaluation of controls in audit planning.
• Aids in determining audit objectives.
• Supporting decision based on risks.

D: A risk event represents the situation where you have a risk that only occurs with a certain probability and where the risk itself is represented by a specified distribution.

Explanation: Risk probability and assessment is completed through interviews and meetings with the participants that are most familiar with the risk events, the project work, or have other information that can help determine the affect of the risk.
Incorrect Answers:
B: The true cost of the risk event is not a qualitative risk assessment approach. It is often done during the quantitative risk analysis process.
C: The probability and impact matrix is a tool and technique to prioritize the risk events, but it’s not the best answer for assessing risk events within the project.
D: Root cause analysis is a risk identification technique, not a qualitative assessment tool.

Explanation:
Threat and vulnerability assessment consider the full spectrum of risks. It identifies the likelihood of occurrence of risks and impact of the significant risks on the organization using the risk scenarios. For example: Natural threats can be evaluated by using historical data concerning frequency of occurrence for given natural disasters such as tornadoes, hurricanes, floods, fire, etc.
Incorrect Answers: A, B: These use either some technical evaluation tool or assessment methodologies to evaluate risk but do not use risk scenarios.
D: Risk assessment uses quantitative and qualitative analysis approaches to evaluate each significant risk identified.

Explanation:
Risk owner for each risk should be the person who has the most influence over its outcome. Selecting the risk owner thus usually involves considering the source of risk and identifying the person who is best placed to understand and implement what needs to be done. They are also responsible for responding to the event and reporting on the risk status.
Incorrect Answers:
A: A risk owner will monitor the identified risks for status changes, but all project stakeholders should be iteratively looking to identify the risks.
B: Risk owners do not pay for the cost of the risk event.
C: Risk owners are not the people who cause the risk event.

Explanation:
The purpose of qualitative risk analysis is to determine what impact the identified risk events will have on the project and the probability they’ll occur. It also puts risks in priority order according to their effects on the project objectives and assigns a risk score for the project.
Incorrect Answers:
B: Risk Management is used to identify, assess, and control risks. It includes analyzing the value of assets to the business, identifying threats to those assets, and evaluating how vulnerable each asset is to those threats. Assessing the probability and consequences of identified risks is only the part of risk management.
C: It involves listing of all the possible risks so as to cure them before it can occur. In risk identification both threats and opportunities are considered, as both carry some level of risk with them.
D: This process does not involve assessing the probability and consequences of identified risks. Quantitative analysis is the use of numerical and statistical techniques rather than the analysis of verbal material for analyzing risks. Some of the quantitative methods of risk analysis are:

• Internal loss method
• External data analysis
• Business process modeling (BPM) and simulation
• Statistical process control (SPC)