nerdexam
(ISC)2

CGRC · Question #644

Neil works as a project manager for SoftTech Inc. He is working with Tom, the COO of his company, on several risks within the project. Tom understands that through qualitative analysis Neil has…

The correct answer is D. Risks may be listed by priority separately for schedule, cost, and performance. Beyond general risk levels, project risks can be prioritized by their impact on specific project objectives such as schedule, cost, and performance, providing a more granular and objective basis for sorting. This allows for a more tailored approach to risk management, focusing…

Security and Privacy Governance, Risk Management, and Compliance Program

Question

Neil works as a project manager for SoftTech Inc. He is working with Tom, the COO of his company, on several risks within the project. Tom understands that through qualitative analysis Neil has identified many risks in the project. Tom's concern, however, is that the priority list of these risk events are sorted in "high- risk," "moderate-risk," and "low-risk" as conditions apply within the project. Tom wants to know that is there any other objective on which Neil can make the priority list for project risks. What will be Neil's reply to Tom? Response:

Options

  • ARisk may be listed by the responses in the near-term
  • BRisks may be listed by categories
  • CRisks may be listed by the additional analysis and response
  • DRisks may be listed by priority separately for schedule, cost, and performance

How the community answered

(27 responses)
  • A
    4% (1)
  • B
    11% (3)
  • C
    4% (1)
  • D
    81% (22)

Why each option

Beyond general risk levels, project risks can be prioritized by their impact on specific project objectives such as schedule, cost, and performance, providing a more granular and objective basis for sorting. This allows for a more tailored approach to risk management, focusing on areas most critical to project success.

ARisk may be listed by the responses in the near-term

Listing risks by near-term responses is a strategy for handling them, not a method for prioritizing the risks themselves based on their inherent characteristics or impact.

BRisks may be listed by categories

Listing risks by categories (e.g., technical, external, organizational) is a way of organizing them, but it doesn't inherently provide a priority order within those categories.

CRisks may be listed by the additional analysis and response

Listing risks by additional analysis and response describes the next steps in risk management, rather than an objective basis for initial prioritization.

DRisks may be listed by priority separately for schedule, cost, and performanceCorrect

Project risks can be prioritized by their potential impact on key project objectives like schedule, cost, and performance, offering a more specific and actionable basis for risk management than just overall qualitative risk levels. This enables stakeholders to understand the direct consequences of risks on critical project aspects.

Concept tested: Project risk prioritization methods

Topics

#Risk Prioritization#Risk Analysis#Risk Management Program#Project Risk

Community Discussion

No community discussion yet for this question.

Full CGRC Practice