システム開発プロジェクトにおけるリスク対応には, 回避, 転嫁, 軽減, 受容などがある。転嫁の事例として, 適切なものはどれか。
平成28年度 春期 ITパスポート試験 問44
This question's explanation and your answers so far.
問 44
- ア
正解 “Transfer” is a response in which the organization does not bear the loss caused by a risk itself, but instead shifts it to a third party. Choice ア, “Take out insurance as a response to financial risk,” is a typical case where, when a loss occurs, the insurance company (a third party) takes on the financial burden instead, which is exactly what risk transfer means. The key point is that by paying a fixed cost (the insurance premium), you move the large loss risk outside the organization.
Incorrectイ
“Reduce the scope” removes from the plan the very work that is the source of the risk, eliminating the possibility that the risk occurs. This is “avoidance,” not transfer.
Incorrectウ
“Carry out more testing” lowers the probability or impact of the risk of defects, which is “mitigation.” It does not shift the risk to a third party, so it is not transfer.
Incorrectエ
“Allocate a contingency reserve needed to deal with the risk if it occurs” accepts the risk without eliminating it and sets aside a contingency reserve to prepare for its occurrence, which is “acceptance.” Because the organization bears the risk itself, it is the opposite idea to transfer.
- The four categories of risk response: avoidance (remove the cause to prevent occurrence), transfer (shift to a third party via insurance, outsourcing, etc.), mitigation (lower the probability or impact), and acceptance (accept it and prepare with a contingency reserve, etc.).
- Taking out insurance shifts the financial burden of a loss to the insurance company, and should be remembered as the representative example of “transfer.”