Risk Management practice questions

Answer: A) An insurer's review of hazards and controls

• ACorrect. It complements experience rating.
• BIncorrect. That's experience rating.
• CIncorrect. That isn't schedule rating.
• DIncorrect. That isn't the basis.

Answer: A) Loss control (risk reduction)

Physical measures that lower how often losses happen (guards) or how severe they are (sprinklers) are loss control, also called risk reduction. They can be combined with retention or transfer, which are risk financing techniques.

• ACorrect. Guards lower how often injuries happen (loss prevention) and sprinklers limit how bad fire losses get (loss reduction). Measures that cut the likelihood or severity of loss are loss control, also called risk reduction or mitigation.
• BIncorrect. Risk transfer shifts the financial burden of a loss to another party, for example through insurance or contractual indemnity. Guards and sprinklers change the loss exposure itself; they don't move its cost to anyone else.
• CIncorrect. Avoidance means eliminating the exposure by not doing, or stopping, the activity. Here the press line keeps running, so the exposure is still there.
• DIncorrect. Retention is a financing decision: the organization pays for losses itself, for example through deductibles or self-insurance. A retained risk can still be controlled, but guards and sprinklers are physical measures that reduce frequency and severity, which makes them loss control rather than retention.

Answer: A) All direct physical loss except excluded causes

• ACorrect. Named perils policies list covered causes.
• BIncorrect. That's named perils.
• CIncorrect. That's too narrow.
• DIncorrect. Exclusions apply.

Answer: C) A trigger such as wind speed is reached

• AIncorrect. A trigger is needed.
• BIncorrect. That's traditional indemnity.
• CCorrect. Payment doesn't depend on assessed damage.
• DIncorrect. That isn't parametric.

Answer: D) Worse-than-average losses

• AIncorrect. It's a premium modifier.
• BIncorrect. That's below 1.0.
• CIncorrect. That's 1.0.
• DCorrect. Premiums rise.

Answer: B) Weighting outcomes by probability

• AIncorrect. That ignores probability.
• BCorrect. It helps compare options.
• CIncorrect. Probabilities must be used.
• DIncorrect. That ignores other outcomes.

Answer: C) Objectives

ISO 31000 defines risk broadly as the effect of uncertainty on objectives, and that effect can be positive or negative. It is not limited to hazards, assets or safety outcomes.

• AIncorrect. A hazard is a source of potential harm, and in traditional safety practice risk is linked to hazards. ISO 31000's definition, however, is framed around objectives, not hazards.
• BIncorrect. Assets can be affected by risk, but ISO 31000 does not define risk in terms of assets. Its definition refers to objectives.
• CCorrect. ISO 31000 defines risk as the effect of uncertainty on objectives. That effect is a deviation from what is expected and can be positive (an opportunity) or negative (a threat).
• DIncorrect. ISO 31000 applies to every type of organizational risk, not only safety. Defining risk as an effect on safety performance would make it too narrow and leave out positive effects on other objectives.

Answer: C) Breach response costs such as forensics and notification, plus business interruption

Cyber insurance transfers the financial impact of cyber incidents, mainly breach response costs (forensics, notification, remediation) and business interruption losses. Injuries, property damage and premises liability are covered by other insurance lines.

• AIncorrect. Occupational injury medical costs and wage replacement are covered by workers' compensation insurance.
• BIncorrect. Physical damage to owned property from perils such as fire or storms is covered by commercial property insurance.
• CCorrect. Cyber policies typically cover first-party incident costs such as investigation, forensics, notification and remediation, as well as income lost to network downtime. Many also cover ransomware or extortion and some liability costs. Coverage varies by policy.
• DIncorrect. Premises bodily injury claims from third parties fall under commercial general liability insurance.

Answer: D) Assuming (retaining) the risk

Risk treatment strategies include avoiding, controlling, transferring, and assuming (retaining) the risk. An informed decision to accept the current level and continue is assumption or retention.

• AIncorrect. Avoidance removes the cause or consequence of the risk, for example by not doing the activity. Here the activity continues.
• BIncorrect. Control means adding measures that act on the causes or system states to lower the risk. No new measures are being added here.
• CIncorrect. Transfer shifts the risk or its consequences to another party, such as through insurance or a contract. The organization keeps the risk here.
• DCorrect. Assuming the risk means making an informed decision to accept the current risk level and continue the current plan.

Answer: B) Insurance premiums, retained (self-funded) losses, and risk management administrative costs

Total cost of risk adds together what the organization pays to transfer risk (premiums), what it absorbs itself (retained losses), and what it spends to run the risk program (administrative and risk control costs).

• AIncorrect. Losses paid by the carrier are already funded through the premium, so adding them double-counts. This set also leaves out retained losses and administrative costs.
• BCorrect. TCOR combines premiums and related costs, the losses the organization keeps (deductibles, self-insured retentions, uninsured losses), and the costs of running the risk program. Risk control spending is often counted as well.
• CIncorrect. That formula gives one workers' compensation premium. It is not a total of all risk-related costs.
• DIncorrect. Reserves and commissions are specific accounting items. Leaving out retained losses, premiums across all lines and administrative costs understates TCOR.