Scenario 5:
Crestview University is a well-known academic institution that recently launched a digital learning platform to support remote education. The platform integrates video lectures, interactive assessments, and student data management. After initial deployment, the risk management team identified several key risks, including unauthorized access to research data, system outages, and data privacy concerns.
To address these, the team discussed multiple risk treatment options. They considered limiting the platform's functionality, but this conflicted with the university's goals. Instead, they chose to partner with a reputable cybersecurity firm and purchase cyber insurance. They also planned to reduce the likelihood of system outages by upgrading server capacity and implementing redundant systems. Some risks, such as occasional minor software glitches, were retained after careful evaluation because they did not significantly affect Crestview's operations. The team considered these risks manageable and agreed to monitor and address them at a later stage. Thus, they documented the accepted risks and decided not to inform any stakeholder at this time.
Once the treatment options were selected, Crestview's risk management team developed a detailed risk treatment plan. They prioritized actions based on which processes carried the highest risk, ensuring cybersecurity measures were addressed first. The plan clearly defined the responsibilities of team members for approving and implementing treatments and identified the resources required, including budget and personnel. To maintain oversight, performance indicators and monitoring schedules were established, and regular progress updates were communicated to the university's top management.
Throughout the risk management process, all activities and decisions were thoroughly documented and communicated through formal channels. This ensured clear communication across departments, supported decision-making, enabled continuous improvement in risk management, and fostered transparency and accountability among stakeholders who manage and oversee risks. Special care was taken to communicate the results of the risk assessment, including any limitations in data or methods, the degree of uncertainty, and the level of confidence in findings. The reporting avoided overstating certainty and included quantifiable measures in appropriate, clearly defined units. Using standardized templates helped streamline documentation, while updates, such as changes to risk treatments, emerging risks, or shifting priorities, were routinely reflected in the system to keep the records current.
Through this methodical and transparent approach, Crestview University ensured that its digital learning platform was supported by a resilient, well-documented, and continuously improving risk management process.
Based on the scenario above, answer the following question:
Which risk treatment option did Crestview University select to address cybersecurity risks?

• A. Risk avoidance by limiting the platform's functionality
• B. Risk sharing by outsourcing and insurance
• C. Risk retention by allowing minor software glitches
• D. Risk acceptance without controls

What is the main focus when organizations communicate risks to operational managers?

• A. Communicating long-term strategic uncertainties
• B. Evaluating the impact of risks on stakeholder confidence and crisis management options
• C. Clarifying the responsibilities of individual risks and emphasizing safety issues
• D. Addressing risk exposures that can be controlled at the operational level and monitoring key performance indicators

Scenario 5:
Crestview University is a well-known academic institution that recently launched a digital learning platform to support remote education. The platform integrates video lectures, interactive assessments, and student data management. After initial deployment, the risk management team identified several key risks, including unauthorized access to research data, system outages, and data privacy concerns.
To address these, the team discussed multiple risk treatment options. They considered limiting the platform's functionality, but this conflicted with the university's goals. Instead, they chose to partner with a reputable cybersecurity firm and purchase cyber insurance. They also planned to reduce the likelihood of system outages by upgrading server capacity and implementing redundant systems. Some risks, such as occasional minor software glitches, were retained after careful evaluation because they did not significantly affect Crestview's operations.
Once the treatment options were selected, Crestview's risk management team developed a detailed risk treatment plan. They prioritized actions based on which processes carried the highest risk, ensuring cybersecurity measures were addressed first.
Based on the scenario above, answer the following question:
In Scenario 5, Crestview University focused on the highest-risk areas first when developing the risk treatment plan. Is this acceptable?

• A. No, all risks should be treated simultaneously to ensure consistency.
• B. Yes, actions in the risk treatment plan should be prioritized based on processes carrying the highest level of risk.
• C. No, risk treatment plans should address low-impact risks first to build experience.
• D. No, prioritization is not permitted under ISO 31000.

A renewable energy company is conducting a facilitated workshop to review potential risks in its power generation systems. The facilitator uses a list of guidewords and prompts such as "what if?" and "how could?" to encourage participants to discuss possible causes, consequences, and existing controls. Which of the following risk identification techniques is being applied?

• A. Failure Modes and Effects Analysis (FMEA)
• B. Structured What-If Technique (SWIFT)
• C. Checklists, classifications, and taxonomies
• D. Delphi technique