問42
頻出度★★★
リスクへの対応策は, 回避, 軽減, 受容, 転嫁の四つに分類することができる。 ある会社で, 個人情報を取り扱うシステムの開発を受託した。その開発プロジェクトにおけるリスク対応策のうち, 個人情報漏えいに関するリスクの軽減に該当するものはどれか。
平成29年度 秋期 ITパスポート試験 問42
マネジメント系プロジェクトマネジメント › プロジェクトマネジメント
This question's explanation and your answers so far.
解説
問 42
- ア
正解 The “mitigation” of a risk means a response measure that lowers the probability of the risk occurring or the impact when it does occur. Choice ア, by prohibiting items from being taken out of the project room without permission, directly lowers the very probability that personal information is taken outside. It does not reduce the risk completely to zero, but because it makes the risk less likely to happen and holds down its impact, it counts as “mitigation.” Therefore the correct answer is ア.
Incorrectイ
Taking out insurance in preparation for a damages claim is a response that has a third party (the insurance company) bear the resulting loss on your behalf, which amounts to “transfer” of the risk. It does not directly lower the probability or impact of a leak, so it is not “mitigation.”
Incorrectウ
Working with fictitious information instead of taking custody of actual personal information is a response that removes the very cause of the personal-information-leakage risk and brings the risk to zero, which amounts to “avoidance.” This differs from “mitigation,” which only lowers the probability.
Incorrectエ
Accepting the risk as it is because the probability is judged to be low, while setting aside a contingency reserve just in case, amounts to “acceptance” — acknowledging the risk and then taking it on. Since no measure is taken to lower the likelihood of a leak, it is not “mitigation.”
ここがポイント
- The key point is being able to distinguish the four categories of risk response — avoidance (remove the cause and bring the risk to zero), mitigation (lower the probability or impact), transfer (shift it to a third party such as via insurance), and acceptance (take it on and prepare with a contingency reserve, etc.).
- The difference from “avoidance” is that “mitigation” does not eliminate the risk completely, but is a measure that makes it less likely to happen / makes the damage smaller.
用語