問56
頻出度★★★
リスクマネジメントに含まれる四つのプロセスであるリスク対応, リスク特定, リスク評価, リスク分析を実施する順番として, 適切なものはどれか。
平成25年度 秋期 ITパスポート試験 問56
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 56
Incorrectア
Starting with “risk identification” is correct, but “risk evaluation” and “risk analysis” are in reverse order. Evaluation can compare a risk against the criteria only once its size has been calculated, so evaluation cannot come before analysis. The order must be analysis (estimating the size) → evaluation (comparing with the criteria and judging).
- イ
正解 The correct answer is イ. Following JIS Q 31000 (ISO 31000), risk management first carries out the earlier half, “risk assessment”, and then, based on its results, carries out the later half, “risk treatment”. Risk assessment consists of three stages: (1) “risk identification” = finding out where risks lie and what kind they are; (2) “risk analysis” = estimating, for each risk found, how often it may occur (its likelihood) and how large its impact would be, and thereby calculating the size of the risk; (3) “risk evaluation” = comparing the calculated size against criteria set in advance (the acceptable level) and judging whether treatment is needed and which risks to handle first. On that basis, as (4) “risk treatment”, concrete measures such as avoidance, reduction, transfer, or retention are chosen and carried out. Therefore “risk identification → risk analysis → risk evaluation → risk treatment” is the correct order. A handy way to remember it: first find them → measure how big they are → compare with criteria and judge → take action.
Incorrectウ
This begins with “risk evaluation”. At a stage where the risks that exist have not yet been listed (risk identification has not been done), there is nothing to evaluate in the first place. Risk management always starts with “risk identification”.
Incorrectエ
It begins with “risk analysis”, placing analysis before identification, which is wrong from the start. It also places “risk treatment” before “risk evaluation”, so action would be taken before judging whether treatment is needed and which risks take priority; that order does not hold. Risk treatment comes last of the four processes.
ここがポイント
- The four risk management processes come in the order “risk identification → risk analysis → risk evaluation → risk treatment”. The first three (identification, analysis, evaluation) are together called “risk assessment”.
- The key is telling the roles of the stages apart: risk identification = listing the risks; risk analysis = calculating the size of each risk from its frequency of occurrence and its degree of impact; risk evaluation = comparing with the criteria to judge whether treatment is needed and with what priority; risk treatment = carrying out concrete measures such as avoidance, reduction, transfer, or retention.
用語