Skip to content

ACCA Strategic Professional · Strategic Business Leader · Identification, assessment and measurement of risk

Delmar Retail estimates that a data breach has a 5% annual probability and would cost $2 million. A fire at a warehouse has a 20% annual probability and would cost $400,000. A board member proposes ranking the risks solely by expected value. What is the key limitation of this approach as applied to these risks?

Expected values are $100,000 for the breach and $80,000 for the fire, but expected value averages outcomes and hides that the breach would be a single large loss. Boards should also consider the size of impact, particularly where one event could threaten the organisation's survival.

  1. AExpected value of the breach is $100,000 against $80,000 for the fire, but averaging hides the catastrophic size of the single breach loss, so impact should also be considered separatelyCorrect
  2. BExpected value of the fire is $400,000 so it must be ranked first
  3. CExpected value ignores probability, so it cannot be calculated
  4. DExpected value shows the breach is less important because its probability is lower

Explanation

Breach: 5% x 2,000,000 = 100,000. Fire: 20% x 400,000 = 80,000. Expected values are similar, but the breach could be a single large loss that threatens survival; expected value averages this out, so impact needs separate attention.

Did you get it right without looking?

One question tells you little. A timed set on Identification, assessment and measurement of risk shows your real accuracy, how long you take and where you lose marks.

Practise Identification, assessment and measurement of riskFree diagnostic mock

More Identification, assessment and measurement of risk questions