Skip to content

ACCA Strategic Professional · Strategic Business Leader · Identification, assessment and measurement of risk

Harbour Freight plc, a logistics group, has plotted its risks on a likelihood-impact matrix. A cyber-attack that would shut down its booking system for a week is rated as low likelihood but very high impact. Which response is most consistent with how such a risk should be treated?

A low-likelihood, high-impact risk should receive priority attention through contingency planning, business continuity and possibly insurance. Impact severity can threaten the organisation's survival even when probability is low, so judging risk by likelihood alone is inadequate and complete avoidance would be disproportionate.

  1. AIgnore it because the low likelihood means the expected loss is trivial
  2. BGive it priority attention, for example through contingency planning and insurance, because the impact could threaten the businessCorrect
  3. CAccept it automatically because only high-likelihood risks need action
  4. DAvoid it by closing the online booking system permanently

Explanation

Low-likelihood, high-impact risks can threaten survival, so they warrant contingency planning, resilience measures or risk transfer. Ignoring them because of low probability is wrong since impact severity matters independently. Permanent closure of the system is disproportionate avoidance.

Did you get it right without looking?

One question tells you little. A timed set on Identification, assessment and measurement of risk shows your real accuracy, how long you take and where you lose marks.

Practise Identification, assessment and measurement of riskFree diagnostic mock

More Identification, assessment and measurement of risk questions