nerdexam
(ISC)2

CAP · Question #327

Nancy is the project manager of the NHH project. She and the project team have identified a significant risk in the project during the qualitative risk analysis process. Bob is familiar with the techn

The correct answer is D. Bob is correct. Not all riskevents have to pass the quantitative risk analysis process to. According to the PMBOK Guide, quantitative risk analysis is an optional process - it is not required for all projects or all risks. Qualitative risk analysis prioritizes risks by probability and impact, and for many risks, that level of analysis is sufficient to develop appropria

Security and Privacy Governance, Risk Management, and Compliance Program

Question

Nancy is the project manager of the NHH project. She and the project team have identified a significant risk in the project during the qualitative risk analysis process. Bob is familiar with the technology that the risk is affecting and proposes to Nancy a solution to the risk event. Nancy tells Bob that she has noted his response, but the risk really needs to pass through the quantitative risk analysis process before creating responses. Bob disagrees and ensures Nancy that his response is most appropriate for the identified risk. Who is correct in this scenario?

Options

  • ABob is correct. Bob is familiar with the technology and the risk event so his response should
  • BNancy is correct. Because Nancy is the project manager she can determine the correct
  • CNancy is correct. All risks of significant probability and impact should pass the quantitative risk
  • DBob is correct. Not all riskevents have to pass the quantitative risk analysis process to

How the community answered

(25 responses)
  • B
    4% (1)
  • C
    4% (1)
  • D
    92% (23)

Explanation

According to the PMBOK Guide, quantitative risk analysis is an optional process - it is not required for all projects or all risks. Qualitative risk analysis prioritizes risks by probability and impact, and for many risks, that level of analysis is sufficient to develop appropriate responses. Quantitative risk analysis (which assigns numerical values to risks, e.g., through Monte Carlo simulations or decision tree analysis) is typically reserved for high-priority risks that require deeper numerical analysis, or for projects where it is warranted by complexity and budget. Nancy's assertion that ALL significant risks must pass through quantitative analysis is incorrect. Risk responses can and often are developed directly after qualitative analysis, especially for well-understood risks where an expert like Bob has sufficient knowledge to propose a sound response.

Topics

#Risk Management Process#Qualitative Risk Analysis#Quantitative Risk Analysis#Risk Response Planning

Community Discussion

No community discussion yet for this question.

Full CAP Practice