問30
頻出度★★★
災害による事業中断へのリスク対策として, データセンタを関東と関西の2か所に設置することとした。このリスク対策は, リスクマネジメントにおける四つのリスク対応のうち, どれに該当するか。
平成22年度 秋期 ITパスポート試験 問30
マネジメント系プロジェクトマネジメント › プロジェクトマネジメント
This question's explanation and your answers so far.
解説
問 30
Incorrectア
Risk transfer (also called risk shifting) means making another party bear, by contract, the burden of the loss or the responsibility for responding when a risk becomes reality. Taking out insurance so that an insurance company compensates for disaster damage, or outsourcing system operation to an external data center provider and making it accountable under an SLA, are the measures that apply. In this question, the second data center is also set up and operated by the company itself, and the company still bears the loss if it is struck. Nothing has been moved to another party, so this is not transfer. Note also that in everyday language the word “transfer” suggests moving house or relocating a site, which makes it easy to read “setting up data centers at two locations” as “the site was relocated” and pick this choice by mistake. Transfer here means only moving the risk to another party.
Incorrectイ
Risk avoidance means stopping the activity that causes the risk itself, or switching to a method that carries no such risk, so that the possibility of the risk occurring becomes zero. Measures such as pulling out of business at a location with high disaster danger, or giving up in-house data center operation entirely, are what apply. In this question the company keeps up the activity of operating its own data centers, and the possibility of being struck by a disaster still remains. Because that possibility has not been eliminated, this is not avoidance.
- ウ
正解 The correct answer is “ウ Mitigation”. Among the four risk responses in risk management (avoidance, mitigation, transfer, retention), risk mitigation (also called risk reduction) means taking measures that make either the probability of occurrence or the size of the damage smaller, on the premise that the risk itself remains. Breaking down the measure in this question gives the following. First, the risk in question is business interruption caused by a disaster. Even if the data centers are placed at two far-apart locations, in the Kanto and Kansai regions, that cannot stop earthquakes, typhoons, or floods from happening at all, so the probability of occurrence does not change. However, if the two sites are spread far apart, business systems can keep running at the other data center even when one region is struck. In other words, the worst outcome of “a disaster stops the whole business” is weakened into a state where “even if some sites stop, the business can continue”. This is exactly a measure that makes the size of the damage (the impact) smaller, so it falls under risk mitigation. Remember that spreading sites to remote regions, duplicating systems, and keeping backups at a remote location are representative means of a BCP (Business Continuity Plan), and at the same time typical examples of mitigation as a risk response.
Incorrectエ
Risk retention (also called risk acceptance) means deliberately taking no special measure, when the impact is small or when the cost of a measure exceeds the loss that is expected, and deciding to cover any loss with the company’s own funds (reserves and the like). In other words, retention is the active choice of doing nothing. In this question the company carries out a concrete and costly measure, setting up a second data center, so this does not count as retention.
ここがポイント
- Tell the four risk responses apart by what the measure does to the risk. Avoidance = stop the activity that causes the risk so the possibility of occurrence becomes zero / mitigation (reduction) = use measures to make the probability of occurrence or the size of the damage smaller (the risk remains) / transfer (shifting) = move the burden of the loss to another party through insurance or outsourcing / retention (acceptance) = take no special measure and absorb the loss within the company.
- A two-site setup in separate regions, duplication (redundancy) of systems or servers, remote backups, and installing a UPS cannot prevent a disaster itself from happening, but they make the damage smaller, so they are all classified as risk mitigation. Contrast this with taking out property insurance, which is transfer, and you will not hesitate between the two even though both are disaster countermeasures.
用語