1
00:00:05,941 --> 00:00:09,690
- Welcome to Lesson 24: Deep Dive Quiz.

2
00:00:09,690 --> 00:00:11,850
Now, Lesson 24 was all about explaining

3
00:00:11,850 --> 00:00:13,530
the risk management process,

4
00:00:13,530 --> 00:00:15,600
and we did four lessons.

5
00:00:15,600 --> 00:00:18,330
24.1, we talked about risk concepts,

6
00:00:18,330 --> 00:00:21,690
24.2, risk assessment and analysis,

7
00:00:21,690 --> 00:00:24,660
24.3, we looked at risk
response and treatment,

8
00:00:24,660 --> 00:00:29,340
and in 24.4, we looked at doing
a business impact analysis.

9
00:00:29,340 --> 00:00:30,173
So are you ready?

10
00:00:30,173 --> 00:00:31,950
Let's do 10 questions together.

11
00:00:31,950 --> 00:00:34,800
Make sure you've got a pen or
a pencil and a piece of paper.

12
00:00:34,800 --> 00:00:36,600
You're gonna wanna write down answers,

13
00:00:36,600 --> 00:00:38,190
and you're gonna want
me to put me on pause

14
00:00:38,190 --> 00:00:39,873
as often as you need.

15
00:00:41,070 --> 00:00:42,240
Are you ready?

16
00:00:42,240 --> 00:00:43,863
Okay, let's get started.

17
00:00:44,894 --> 00:00:47,130
Your organization's Board of Directors

18
00:00:47,130 --> 00:00:50,010
recently adopted a Risk
Appetite Statement.

19
00:00:50,010 --> 00:00:54,120
When published, what should
one learn from the statement?

20
00:00:54,120 --> 00:00:55,860
The acceptable variation in outcomes

21
00:00:55,860 --> 00:00:58,800
related to specific key
performance indicators

22
00:00:58,800 --> 00:01:00,900
or key risk indicators.

23
00:01:00,900 --> 00:01:03,570
The amount of insurance
that should be purchased.

24
00:01:03,570 --> 00:01:06,390
Actions that should be
taken to mitigate the impact

25
00:01:06,390 --> 00:01:08,550
of an unfavorable outcome.

26
00:01:08,550 --> 00:01:09,383
Or the level of risk

27
00:01:09,383 --> 00:01:12,240
that the organization is willing to accept

28
00:01:12,240 --> 00:01:15,634
in pursuit of its mission and objectives.

29
00:01:15,634 --> 00:01:19,043
Now, read through those again and tell me,

30
00:01:19,043 --> 00:01:22,593
what should I learn from
a Risk Appetite Statement?

31
00:01:26,270 --> 00:01:28,980
Well, I'm gonna choose the last one,

32
00:01:28,980 --> 00:01:29,853
which is the level of risk

33
00:01:29,853 --> 00:01:32,430
that the organization is willing to accept

34
00:01:32,430 --> 00:01:34,830
in pursuit of its mission and objectives.

35
00:01:34,830 --> 00:01:35,820
That's the whole reason

36
00:01:35,820 --> 00:01:38,880
why we have a Risk Appetite Statement.

37
00:01:38,880 --> 00:01:40,260
If we look at the other answers,

38
00:01:40,260 --> 00:01:42,300
actions should be taken
to mitigate the impact

39
00:01:42,300 --> 00:01:44,190
of an unfavorable outcome.

40
00:01:44,190 --> 00:01:46,830
That's not gonna be in a Risk
Assessment Statement, right?

41
00:01:46,830 --> 00:01:48,540
That's really gonna be our risk mitigation

42
00:01:48,540 --> 00:01:49,767
or risk treatment.

43
00:01:49,767 --> 00:01:52,560
And the amount of insurance
that should be purchased.

44
00:01:52,560 --> 00:01:54,570
Well, that's really just
a risk treatment option,

45
00:01:54,570 --> 00:01:57,510
and acceptable variation in outcomes

46
00:01:57,510 --> 00:01:59,760
related to key specific
performance indicators

47
00:01:59,760 --> 00:02:01,380
or key risk indicators,

48
00:02:01,380 --> 00:02:03,090
that's gonna be risk tolerance,

49
00:02:03,090 --> 00:02:05,760
and when we're talking
about specific indicators

50
00:02:05,760 --> 00:02:09,120
and how much variance
we're willing to accept,

51
00:02:09,120 --> 00:02:10,590
that's risk tolerance.

52
00:02:10,590 --> 00:02:12,150
So I'm going with level of risk

53
00:02:12,150 --> 00:02:14,430
the organization is willing to accept

54
00:02:14,430 --> 00:02:17,010
in pursuit of its mission and objectives.

55
00:02:17,010 --> 00:02:17,850
Agree?

56
00:02:17,850 --> 00:02:18,753
Let's check.

57
00:02:19,650 --> 00:02:20,703
And that's correct.

58
00:02:21,790 --> 00:02:23,730
Okay, we are gonna complete the sentence

59
00:02:23,730 --> 00:02:25,650
by dragging and dropping the terms.

60
00:02:25,650 --> 00:02:26,940
So let me read you the sentence,

61
00:02:26,940 --> 00:02:29,310
and we'll look at the available terms.

62
00:02:29,310 --> 00:02:34,230
Key risk indicators, KRIs,
are blank of blank events

63
00:02:34,230 --> 00:02:37,560
that can adversely impact an organization.

64
00:02:37,560 --> 00:02:40,890
A blank looks forward at
future outcomes and events,

65
00:02:40,890 --> 00:02:44,193
and a blank looks back at what happened.

66
00:02:45,851 --> 00:02:49,500
So we've got favorable,
key performance indicators,

67
00:02:49,500 --> 00:02:53,220
predictors, lagging
indicator, unfavorable,

68
00:02:53,220 --> 00:02:55,200
and leading indicator.

69
00:02:55,200 --> 00:02:59,580
So key risk indicators
are blank of blank events

70
00:02:59,580 --> 00:03:02,910
that can adversely impact an organization.

71
00:03:02,910 --> 00:03:05,580
A blank looks forward at
future outcomes and events,

72
00:03:05,580 --> 00:03:08,313
and a blank looks back at what happened.

73
00:03:10,980 --> 00:03:11,940
What do you wanna do?

74
00:03:11,940 --> 00:03:14,240
Go ahead and put me on
pause while you choose.

75
00:03:18,510 --> 00:03:22,710
Well, key risk indicators
by their very definition

76
00:03:22,710 --> 00:03:27,710
are going to be predictors
of unfavorable events

77
00:03:29,010 --> 00:03:33,030
that can adversely impact an organization.

78
00:03:33,030 --> 00:03:36,690
Now we have a blank looks
forward and a blank looks back.

79
00:03:36,690 --> 00:03:38,943
So what looks forward and what looks back?

80
00:03:40,680 --> 00:03:43,320
A leading indicator is gonna look forward

81
00:03:43,320 --> 00:03:45,390
at future outcomes and events.

82
00:03:45,390 --> 00:03:47,250
So what's gonna look back?

83
00:03:47,250 --> 00:03:50,010
That's gonna be a lagging indicator

84
00:03:50,010 --> 00:03:52,140
looks back at what happens.

85
00:03:52,140 --> 00:03:54,480
So key risk indicators, KRIs,

86
00:03:54,480 --> 00:03:56,460
are predictors of unfavorable events

87
00:03:56,460 --> 00:03:59,340
that can adversely impact an organization.

88
00:03:59,340 --> 00:04:00,930
A leading indicator looks forward

89
00:04:00,930 --> 00:04:02,730
at future outcome and events.

90
00:04:02,730 --> 00:04:05,850
A lagging indicator looks
back at what happened.

91
00:04:05,850 --> 00:04:06,840
You good with it?

92
00:04:06,840 --> 00:04:07,863
Let's check.

93
00:04:08,880 --> 00:04:10,590
And that is correct.

94
00:04:10,590 --> 00:04:12,740
All right, let's move
on to question three.

95
00:04:14,280 --> 00:04:17,820
An organization has determined
that one day of e-commerce

96
00:04:17,820 --> 00:04:19,860
is worth $10,000,

97
00:04:19,860 --> 00:04:22,530
and if one server on
the server farm failed,

98
00:04:22,530 --> 00:04:27,240
the ability to service
customers would degrade 15%.

99
00:04:27,240 --> 00:04:29,310
Now, based on past experience,

100
00:04:29,310 --> 00:04:33,517
they anticipate a failure
three times a year.

101
00:04:33,517 --> 00:04:35,190
So what are we gonna do?

102
00:04:35,190 --> 00:04:39,540
We're gonna match the quantitative
risk assessment elements.

103
00:04:39,540 --> 00:04:44,497
We're gonna look for SLE,
ALE, AV, EF, and ARO.

104
00:04:46,650 --> 00:04:50,940
They told us that one day of
e-commerce is worth $10,000.

105
00:04:50,940 --> 00:04:53,040
So e-commerce is our target,

106
00:04:53,040 --> 00:04:54,960
and we happen to be doing it by the day.

107
00:04:54,960 --> 00:04:59,043
So our AV, our asset value
is going to be 10,000.

108
00:04:59,945 --> 00:05:01,290
Then what do they tell us?

109
00:05:01,290 --> 00:05:06,150
Well, they tell us that the
impact would be 15%, right?

110
00:05:06,150 --> 00:05:09,630
The ability to service
customers would degrade 15%.

111
00:05:09,630 --> 00:05:14,630
That's our impact, so that
means our EF is going to be 15%.

112
00:05:15,769 --> 00:05:18,060
All right, so let's do our SLE.

113
00:05:18,060 --> 00:05:22,110
SLE is going to be our asset value

114
00:05:22,110 --> 00:05:24,510
times our exposure factor,

115
00:05:24,510 --> 00:05:28,620
so 15% of $10,000.

116
00:05:28,620 --> 00:05:32,673
I believe our SLE is going to be $1,500.

117
00:05:34,050 --> 00:05:35,100
Then they tell us,

118
00:05:35,100 --> 00:05:39,270
well, we can expect this to
happen three times a year.

119
00:05:39,270 --> 00:05:42,720
Well, that makes our ARO three,

120
00:05:42,720 --> 00:05:44,700
and what's our ALE formula?

121
00:05:44,700 --> 00:05:48,390
Our ALE formula is gonna be
our SLE, which was 1,500,

122
00:05:48,390 --> 00:05:51,000
times our ARO, which is three,

123
00:05:51,000 --> 00:05:54,930
and that gives us an ALE of 4,500.

124
00:05:54,930 --> 00:05:59,930
So in this scenario, our SLE
was 1,500, our ALE was 4,500,

125
00:06:01,380 --> 00:06:04,020
our original asset value was 10,000,

126
00:06:04,020 --> 00:06:07,230
our exposure factor was 15%,

127
00:06:07,230 --> 00:06:09,993
and our annualized rate
of occurrence was three.

128
00:06:11,130 --> 00:06:11,963
How'd you do?

129
00:06:11,963 --> 00:06:12,796
Do it well?

130
00:06:12,796 --> 00:06:13,629
Awesome.

131
00:06:14,760 --> 00:06:17,763
All right, let's check,
and we are correct.

132
00:06:20,160 --> 00:06:21,600
All right, this group is responsible

133
00:06:21,600 --> 00:06:25,500
for determining maximum
tolerable downtime, or MTD.

134
00:06:25,500 --> 00:06:27,900
A business unit, an IT department,

135
00:06:27,900 --> 00:06:30,300
an information security department,

136
00:06:30,300 --> 00:06:32,490
or the board of directors.

137
00:06:32,490 --> 00:06:34,950
Who's responsible for determining MTD

138
00:06:34,950 --> 00:06:37,830
for a particular business process?

139
00:06:37,830 --> 00:06:41,580
The business unit, IT, the
information security department,

140
00:06:41,580 --> 00:06:43,590
or the board of directors?

141
00:06:43,590 --> 00:06:45,240
I know you know this right away.

142
00:06:45,240 --> 00:06:47,340
Go ahead, and let's just say it.

143
00:06:47,340 --> 00:06:49,380
It is the business unit, right?

144
00:06:49,380 --> 00:06:53,100
MTD, maximum tolerable
downtime, not an IT issue.

145
00:06:53,100 --> 00:06:55,620
It is not an information security issue

146
00:06:55,620 --> 00:06:57,300
or cybersecurity issue.

147
00:06:57,300 --> 00:06:59,730
It doesn't go all the way up
to the board of directors.

148
00:06:59,730 --> 00:07:01,800
They don't get involved in that minutia.

149
00:07:01,800 --> 00:07:04,200
It is a business unit decision,

150
00:07:04,200 --> 00:07:07,440
so let's check, and that's correct.

151
00:07:07,440 --> 00:07:08,690
All right, question five.

152
00:07:09,780 --> 00:07:13,740
How fast an exposure
impacts an organization.

153
00:07:13,740 --> 00:07:17,370
Is that likelihood, the
window of opportunity,

154
00:07:17,370 --> 00:07:20,613
the window of vulnerability, or velocity?

155
00:07:21,930 --> 00:07:25,860
This is how fast an exposure
will impact an organization.

156
00:07:25,860 --> 00:07:28,320
Likelihood, window of opportunity,

157
00:07:28,320 --> 00:07:31,113
window of vulnerability, or velocity.

158
00:07:31,963 --> 00:07:33,600
Are you ready to choose?

159
00:07:33,600 --> 00:07:35,940
I'm gonna choose velocity

160
00:07:35,940 --> 00:07:40,800
because that's how fast an
exposure impacts an organization.

161
00:07:40,800 --> 00:07:44,160
Let's check, and that is correct.

162
00:07:44,160 --> 00:07:46,010
All right, moving on to question six.

163
00:07:46,920 --> 00:07:49,500
The principle that,
often, risks are linked,

164
00:07:49,500 --> 00:07:51,750
and failing to address one risk

165
00:07:51,750 --> 00:07:54,240
could cause a chain reaction.

166
00:07:54,240 --> 00:07:57,390
Is this serial risk, regression risk,

167
00:07:57,390 --> 00:08:00,783
cascading risk, or parallel risk?

168
00:08:03,450 --> 00:08:05,790
Now, one of these encompasses two others,

169
00:08:05,790 --> 00:08:07,233
and then one's an outlier.

170
00:08:08,100 --> 00:08:10,440
So this is the principle
that risks are linked,

171
00:08:10,440 --> 00:08:12,180
and failing to address one risk

172
00:08:12,180 --> 00:08:14,013
could cause a chain reaction.

173
00:08:15,630 --> 00:08:17,180
Put me on pause if you need to.

174
00:08:18,870 --> 00:08:21,630
This is going to be cascading risk.

175
00:08:21,630 --> 00:08:24,210
That's the idea that
risks are often linked,

176
00:08:24,210 --> 00:08:25,500
and if you fail to address one,

177
00:08:25,500 --> 00:08:28,650
it can cause a chain
reaction, or cascading.

178
00:08:28,650 --> 00:08:30,060
Now, there are two types of,

179
00:08:30,060 --> 00:08:32,190
or three types, really, of cascading risk.

180
00:08:32,190 --> 00:08:35,460
We have serial risk is a
type of cascading risk,

181
00:08:35,460 --> 00:08:38,310
we have parallel risk, which
is a type of cascading risk,

182
00:08:38,310 --> 00:08:40,110
and then we have hybrid.

183
00:08:40,110 --> 00:08:42,390
Regression risk is the risk that occurs

184
00:08:42,390 --> 00:08:43,590
whenever we've made a change.

185
00:08:43,590 --> 00:08:45,060
So if we've made a change in system

186
00:08:45,060 --> 00:08:46,680
or a change in code,

187
00:08:46,680 --> 00:08:50,490
making that change could
be our regression risk.

188
00:08:50,490 --> 00:08:53,823
Let's double check, and that is correct.

189
00:08:54,870 --> 00:08:56,310
All right, question seven.

190
00:08:56,310 --> 00:08:58,830
Let's match the following
risk treatment strategies

191
00:08:58,830 --> 00:09:00,450
with their descriptions.

192
00:09:00,450 --> 00:09:04,800
We have accept, transfer,
mitigate, and terminate.

193
00:09:04,800 --> 00:09:06,480
That's down the left hand side.

194
00:09:06,480 --> 00:09:07,320
On the right hand side,

195
00:09:07,320 --> 00:09:09,990
we have acknowledge the risk
and continue to monitor,

196
00:09:09,990 --> 00:09:13,830
eliminate the cause or cease
the associated activity,

197
00:09:13,830 --> 00:09:16,140
reduce the impact or likelihood

198
00:09:16,140 --> 00:09:19,140
by implementing additional
controls or safeguards,

199
00:09:19,140 --> 00:09:21,330
or assign the risk to another party,

200
00:09:21,330 --> 00:09:23,550
generally via insurance.

201
00:09:23,550 --> 00:09:24,660
So go ahead and put me on pause

202
00:09:24,660 --> 00:09:26,853
and match these up then come on back.

203
00:09:28,830 --> 00:09:30,420
All right, let's start with accept.

204
00:09:30,420 --> 00:09:31,253
Oh, it's right there.

205
00:09:31,253 --> 00:09:32,426
I like that.

206
00:09:32,426 --> 00:09:34,860
Acknowledge the risk
and continue to monitor.

207
00:09:34,860 --> 00:09:36,690
What about transferring the risk?

208
00:09:36,690 --> 00:09:37,794
Let's see.

209
00:09:37,794 --> 00:09:39,030
Eliminating, reducing.

210
00:09:39,030 --> 00:09:40,050
There it is.

211
00:09:40,050 --> 00:09:43,470
Transfer the risk, assign
the risk to another party,

212
00:09:43,470 --> 00:09:45,630
or transfer the risk to another party,

213
00:09:45,630 --> 00:09:48,030
generally via insurance.

214
00:09:48,030 --> 00:09:51,780
And we do this generally when
the the likelihood is low

215
00:09:51,780 --> 00:09:53,880
but the impact would be really high.

216
00:09:53,880 --> 00:09:56,133
It's like why you carry
personal insurance.

217
00:09:57,210 --> 00:09:59,100
Mitigate, well, it's right there.

218
00:09:59,100 --> 00:10:01,770
We're gonna reduce the
impact and/or likelihood

219
00:10:01,770 --> 00:10:04,680
by implementing additional
controls and safeguards.

220
00:10:04,680 --> 00:10:07,020
And termination's ready to match as well.

221
00:10:07,020 --> 00:10:10,290
Eliminate the cause or cease
the associated activity.

222
00:10:10,290 --> 00:10:13,290
So accept is to acknowledge the risk

223
00:10:13,290 --> 00:10:15,060
and continue to monitor it.

224
00:10:15,060 --> 00:10:17,520
Transfer is to assign the
risk to another party,

225
00:10:17,520 --> 00:10:19,770
generally via insurance.

226
00:10:19,770 --> 00:10:22,890
Mitigate is to reduce the
impact and/or likelihood

227
00:10:22,890 --> 00:10:25,470
by implementing additional
controls or safeguards,

228
00:10:25,470 --> 00:10:29,190
and terminate is to either
eliminate the cause,

229
00:10:29,190 --> 00:10:33,240
generally very hard to do, or
cease the associated activity.

230
00:10:33,240 --> 00:10:36,393
And great, let's check, and we're good.

231
00:10:37,440 --> 00:10:39,060
All right, question eight.

232
00:10:39,060 --> 00:10:41,880
A business unit has determined
that their application

233
00:10:41,880 --> 00:10:46,770
has a maximum tolerable
downtime, MTD, of two hours.

234
00:10:46,770 --> 00:10:49,530
Which statement below
supports this requirement?

235
00:10:49,530 --> 00:10:50,610
So the word here is support.

236
00:10:50,610 --> 00:10:52,500
Not expresses this requirement,

237
00:10:52,500 --> 00:10:54,870
but supports this requirement.

238
00:10:54,870 --> 00:10:59,870
MTO equals two, RPO is less than two,

239
00:10:59,940 --> 00:11:04,920
RTO is less than two, or RTO equals two.

240
00:11:04,920 --> 00:11:07,830
So the business unit says
they have an MTD of two,

241
00:11:07,830 --> 00:11:10,170
so MTD would equal two.

242
00:11:10,170 --> 00:11:13,050
Which statement is gonna
help them achieve that?

243
00:11:13,050 --> 00:11:16,530
MTO equals two, RPO is less than two,

244
00:11:16,530 --> 00:11:20,553
RTO is less than two, or RTO equals two.

245
00:11:21,840 --> 00:11:22,860
What do you think?

246
00:11:22,860 --> 00:11:25,013
Put me on pause if you
wanna think about it.

247
00:11:27,480 --> 00:11:29,490
All right, well, MTO equals two

248
00:11:29,490 --> 00:11:32,100
is really just the same
as saying MTD equals two,

249
00:11:32,100 --> 00:11:34,770
because MTO and MTD are interchangeable,

250
00:11:34,770 --> 00:11:37,410
so that doesn't really
support the requirement.

251
00:11:37,410 --> 00:11:40,800
RPO, recovery point objective,
is all about data, right?

252
00:11:40,800 --> 00:11:44,010
So we're not learning
anything here in this scenario

253
00:11:44,010 --> 00:11:46,323
about their data loss
or data requirements.

254
00:11:47,880 --> 00:11:51,330
RTO less than two, that's
a recovery time objective.

255
00:11:51,330 --> 00:11:52,440
Probably a pretty good answer.

256
00:11:52,440 --> 00:11:54,030
Let's look at all of them, though.

257
00:11:54,030 --> 00:11:55,800
RTO equals two.

258
00:11:55,800 --> 00:11:58,140
No, we don't want it be equal to our MTD.

259
00:11:58,140 --> 00:12:00,900
We always wanna be less than our MTD.

260
00:12:00,900 --> 00:12:03,270
So I'm going with our
recovery time objective

261
00:12:03,270 --> 00:12:04,710
is less than two,

262
00:12:04,710 --> 00:12:07,350
and that would support the requirement

263
00:12:07,350 --> 00:12:11,280
that our maximum tolerable
downtime is two hours.

264
00:12:11,280 --> 00:12:14,220
Let's check, and that's correct.

265
00:12:14,220 --> 00:12:15,783
All right, question nine.

266
00:12:17,040 --> 00:12:19,950
We again are gonna have to
drag and drop some terms here.

267
00:12:19,950 --> 00:12:22,590
We're gonna drag and drop
the risk-related terms

268
00:12:22,590 --> 00:12:23,820
to the correct place.

269
00:12:23,820 --> 00:12:25,590
So let's read the whole thing first.

270
00:12:25,590 --> 00:12:27,810
It's not always possible to avoid transfer

271
00:12:27,810 --> 00:12:30,870
or mitigate a risk to an acceptable level.

272
00:12:30,870 --> 00:12:33,060
A blank is a formal acknowledgement

273
00:12:33,060 --> 00:12:34,980
that a risk has been identified,

274
00:12:34,980 --> 00:12:37,020
but it's not feasible or practical

275
00:12:37,020 --> 00:12:38,880
to implement risk treatment.

276
00:12:38,880 --> 00:12:41,160
Now, the process of approving an exception

277
00:12:41,160 --> 00:12:43,350
on either a temporary or permanent basis

278
00:12:43,350 --> 00:12:45,690
is known as a blank.

279
00:12:45,690 --> 00:12:50,490
A blank is a formal decision
not to address a risk at all,

280
00:12:50,490 --> 00:12:51,750
generally implemented

281
00:12:51,750 --> 00:12:55,560
when the treatment cost and
risk are disproportionate.

282
00:12:55,560 --> 00:12:58,050
I even got an embedded hint in there.

283
00:12:58,050 --> 00:13:00,630
All right, so we got
three blanks to fill in.

284
00:13:00,630 --> 00:13:04,050
Our options are risk
assessment, exception handling,

285
00:13:04,050 --> 00:13:06,060
risk treatment, risk exemption,

286
00:13:06,060 --> 00:13:09,003
risk management, or risk exception.

287
00:13:12,690 --> 00:13:15,480
So a blank is a formal acknowledgement

288
00:13:15,480 --> 00:13:17,580
that a risk has been identified,

289
00:13:17,580 --> 00:13:20,763
but is not feasible or
practical to implement.

290
00:13:21,750 --> 00:13:24,960
Risk exception is gonna be
a formal acknowledgement

291
00:13:24,960 --> 00:13:26,700
that a risk has been identified

292
00:13:26,700 --> 00:13:28,920
and it's not feasible or practical

293
00:13:28,920 --> 00:13:30,723
to implement a risk treatment.

294
00:13:31,710 --> 00:13:34,620
So the process of approving an exception

295
00:13:34,620 --> 00:13:37,680
on either a temporary or permanent basis

296
00:13:37,680 --> 00:13:42,030
is gonna be known as exception handling.

297
00:13:42,030 --> 00:13:46,290
A blank is a formal decision
not to address the risk at all,

298
00:13:46,290 --> 00:13:47,340
generally implemented

299
00:13:47,340 --> 00:13:50,670
when the treatment costs and
the risk are disproportionate,

300
00:13:50,670 --> 00:13:54,990
and that's going to be a risk exemption.

301
00:13:54,990 --> 00:13:58,560
That's the formal decision not
to address the risk at all.

302
00:13:58,560 --> 00:14:00,000
So let's read the whole thing.

303
00:14:00,000 --> 00:14:02,010
It's not always possible to avoid transfer

304
00:14:02,010 --> 00:14:04,560
or mitigate a risk to an acceptable level.

305
00:14:04,560 --> 00:14:06,900
A risk exception is a
formal acknowledgement

306
00:14:06,900 --> 00:14:08,730
that a risk has been identified

307
00:14:08,730 --> 00:14:10,500
but is not feasible or practical

308
00:14:10,500 --> 00:14:12,210
to implement risk treatment.

309
00:14:12,210 --> 00:14:14,010
The process of approving an exception

310
00:14:14,010 --> 00:14:16,650
on either a temporary or permanent basis

311
00:14:16,650 --> 00:14:18,630
is known as exception handling.

312
00:14:18,630 --> 00:14:21,930
And a risk exemption is a formal decision

313
00:14:21,930 --> 00:14:24,120
not to address a risk at all,

314
00:14:24,120 --> 00:14:25,230
generally implemented

315
00:14:25,230 --> 00:14:28,827
when the treatment cost and
the risk are disproportionate.

316
00:14:28,827 --> 00:14:29,660
You like it?

317
00:14:29,660 --> 00:14:30,493
You agree?

318
00:14:30,493 --> 00:14:33,363
Let's double check, and we are correct.

319
00:14:34,950 --> 00:14:37,620
And lastly, dynamic, central repository

320
00:14:37,620 --> 00:14:41,250
for all risk-related
documentation and tracking.

321
00:14:41,250 --> 00:14:44,220
This is a heatmap, a risk dashboard,

322
00:14:44,220 --> 00:14:47,493
a risk record, or a risk register.

323
00:14:48,660 --> 00:14:49,510
What do you like?

324
00:14:51,210 --> 00:14:54,630
Well, I'm gonna choose a risk register,

325
00:14:54,630 --> 00:14:57,570
because a risk register is
a dynamic central repository

326
00:14:57,570 --> 00:15:01,770
for all risk-related
documentation and tracking.

327
00:15:01,770 --> 00:15:04,140
Let's check, and it's correct.

328
00:15:04,140 --> 00:15:05,400
Congratulations.

329
00:15:05,400 --> 00:15:06,233
Great job.

330
00:15:06,233 --> 00:15:07,950
10 questions, you did fabulous.

331
00:15:07,950 --> 00:15:08,970
All right, what are we doing next?

332
00:15:08,970 --> 00:15:11,070
Well, we're gonna go into Lesson 25.

333
00:15:11,070 --> 00:15:12,360
We're gonna explain the processes

334
00:15:12,360 --> 00:15:16,860
associated with third-party
risk assessment and management.

335
00:15:16,860 --> 00:15:17,810
I'll see you there.