あるシステム開発プロジェクトでは, システムを構成する一部のプログラムが複雑で, そのプログラムの作成には高度なスキルを保有する特定の要員を確保する必要があった。そこで, そのプログラムの開発の遅延に備えるために, リスク対策を検討することにした。リスク対策を, 回避, 軽減, 受容, 転嫁に分類するとき, 軽減に該当するものはどれか。
平成29年度 春期 ITパスポート試験 問47
This question's explanation and your answers so far.
問 47
Incorrectア
Judging that the possibility of being unable to secure personnel is low, this response deliberately takes no special measures and bears the risk as is. This is “acceptance,” tolerating the loss even if it occurs, not mitigation, which lowers the impact or probability.
- イ
正解 Risk mitigation means measures that reduce a risk's probability of occurrence or degree of impact to an acceptable level. In choice イ, by bringing in substitute personnel whose skills are somewhat insufficient but who can develop the complex programs, the response ensures that even if the specific personnel cannot be secured, “no large delay occurs.” It does not completely eliminate the risk itself, but it keeps the magnitude of the impact—the delay—small, so it corresponds to mitigation.
Incorrectウ
By outsourcing the development of the complex programs and concluding a contract to deliver the deliverables by the deadline, the responsibility for delay is placed on a third party. This is “transfer,” moving the risk to someone else, not mitigation.
Incorrectエ
Changing the design from the complex program to a combination of simple programs so that personnel with advanced skills are no longer needed. This is “avoidance,” removing the very cause of the risk, not mitigation.
- The four categories of risk response — avoidance (eliminating the cause or changing the plan to remove the risk), mitigation (reducing the probability of occurrence or the degree of impact), acceptance (accepting it without taking measures), and transfer (moving it to a third party).
- The difference between mitigation and avoidance — mitigation does not make the risk zero but only lowers its impact or probability, whereas avoidance removes the very cause of the risk so that it does not occur.