What does ISO/TS 31050 provide?

• A. Requirements for establishing a risk management framework
• B. Basic vocabulary related to risk management
• C. Guidelines on the selection and application of techniques for assessing risk
• D. Guidelines for managing an emerging risk faced by an organization

Scenario 5:
Crestview University is a well-known academic institution that recently launched a digital learning platform to support remote education. The platform integrates video lectures, interactive assessments, and student data management. After initial deployment, the risk management team identified several key risks, including unauthorized access to research data, system outages, and data privacy concerns.
To address these, the team discussed multiple risk treatment options. They considered limiting the platform's functionality, but this conflicted with the university's goals. Instead, they chose to partner with a reputable cybersecurity firm and purchase cyber insurance. They also planned to reduce the likelihood of system outages by upgrading server capacity and implementing redundant systems. Some risks, such as occasional minor software glitches, were retained after careful evaluation because they did not significantly affect Crestview's operations. The team considered these risks manageable and agreed to monitor and address them at a later stage. Thus, they documented the accepted risks and decided not to inform any stakeholder at this time.
Once the treatment options were selected, Crestview's risk management team developed a detailed risk treatment plan. They prioritized actions based on which processes carried the highest risk, ensuring cybersecurity measures were addressed first. The plan clearly defined the responsibilities of team members for approving and implementing treatments and identified the resources required, including budget and personnel. To maintain oversight, performance indicators and monitoring schedules were established, and regular progress updates were communicated to the university's top management.
Throughout the risk management process, all activities and decisions were thoroughly documented and communicated through formal channels. This ensured clear communication across departments, supported decision-making, enabled continuous improvement in risk management, and fostered transparency and accountability among stakeholders who manage and oversee risks. Special care was taken to communicate the results of the risk assessment, including any limitations in data or methods, the degree of uncertainty, and the level of confidence in findings. The reporting avoided overstating certainty and included quantifiable measures in appropriate, clearly defined units. Using standardized templates helped streamline documentation, while updates, such as changes to risk treatments, emerging risks, or shifting priorities, were routinely reflected in the system to keep the records current.
Based on the scenario above, answer the following question:
In Scenario 5, what approach was used by Crestview to ensure effective documentation of its risk management process?

• A. Informal notes maintained by individual team members
• B. Tailored document formats based on the communication style of each stakeholder group
• C. Decentralized storage of documents across departmental systems to allow flexible access
• D. Standardized formats with version control, author, and approval dates

In the context of risk management, which statement below regarding events is correct?

• A. An event can consist of something not happening
• B. An event always has a single cause
• C. An event cannot be a risk source
• D. An event can have only one occurrence

What is one way organizations can reduce consultation fatigue during risk management processes?

• A. Involving the same group of people in every consultation session
• B. Clarifying the role of consultees to streamline participation
• C. Increasing the number of consultation meetings to gather more feedback
• D. Requiring mandatory attendance at all consultations