Scenario: Heatmap Interpretation

A risk heatmap for a retail company shows several risks in the “amber” (moderate) zone,

including supply chain delays and IT system outages. Only one risk—data breach—is in the

“red” (high) zone.

How should the company prioritize its risk response?

Scenario: Residual Risk Evaluation

After implementing several controls to mitigate the risk of workplace accidents, a factory still

experiences occasional minor incidents. The residual risk is now within the organization’s

risk tolerance, but some managers believe further investment in safety is needed.

What is the best course of action?

Scenario: Regulatory Change

A pharmaceutical company faces a new regulatory requirement that could significantly

increase compliance costs. The likelihood of the regulation being enforced is moderate, but

the impact on profitability is high. The company’s risk tolerance allows for only a 5%

reduction in annual profit.

What should the company do first?

Scenario: Supply Chain Disruption

A global manufacturing company relies on a single supplier for a critical component. Political

instability in the supplier’s country has increased the likelihood of supply chain disruption.

The company’s risk appetite is low for operational interruptions.

What is the most appropriate risk treatment?

 Scenario: Cybersecurity Risk in a Financial Institution

A major financial institution has identified a potential risk of a sophisticated cyberattack

targeting its online banking platform. The likelihood is assessed as “high” due to recent

industry trends, and the impact is “critical” because of potential financial loss and

reputational damage. The institution has robust firewalls and regular employee training, but

new vulnerabilities are constantly emerging.

Which risk management strategy should the institution prioritize?

Scenario: A construction company consults structural engineers to identify potential

risks related to building stability and safety.

Which risk identification technique is being utilized?

Scenario: A company faces fines for not adhering to environmental regulations. The risk

manager wants to categorize this risk for reporting purposes.

Which risk category does this incident fall under?

Scenario: During a project kickoff meeting, the team openly discusses potential risks

such as delays in material delivery, technical challenges, and resource constraints.

Which risk identification technique is being applied?