BSBRSK501 Manage Risk Learner Workbook

The BSBRSK501 Manage Risk Learner Workbook provides an opportunity to review organizational processes, procedures and requirements for undertaking risk management in accordance with current risk management standards. It includes activities such as identifying internal and external stakeholders and their issues, determining scope for risk management processes, and reviewing political, economic, social, legal, technological and policy context. The workbook also includes observation/demonstration tasks and a competency record to be completed by the assessor. Course code, course name, and college/university are not mentioned.

BSBRSK501
Manage risk
Learner Workbook

P a g e | 1
Table of Contents
Table of Contents.............................................................................................................................1
Candidate Details.............................................................................................................................2
Assessment – BSBRSK501: Manage risk.........................................................................................2
Competency Record to be completed by Assessor........................................................................3
Observation/Demonstration............................................................................................................4
Activities...........................................................................................................................................5
Activity 1.1.1 – 1.1.3......................................................................................................................5
Activity 1.2.1 – 1.2.3......................................................................................................................7
Activity 1.3.1 – 1.3.4......................................................................................................................8
Activity 1.4.1................................................................................................................................10
Activity 1.5.1 – 1.5.2....................................................................................................................12
Activity 1.6.1 - 1.8.1.....................................................................................................................13
Activity 2.1.1 – 2.3.1....................................................................................................................15
Activity 3.1.1 – 3.3.2....................................................................................................................17
Activity 4.1.1 – 4.1.2....................................................................................................................19
Activity 4.2.1 – 4.3.1....................................................................................................................20
Activity 4.4.1 – 4.4.2....................................................................................................................21
Activity 4.5.1 – 4.5.2....................................................................................................................22
Activity 4.6.1................................................................................................................................23
Skills and Knowledge Activity.......................................................................................................24
MajorActivity...............................................................................................................................25

P a g e | 2
Candidate Details
Assessment – BSBRSK501: Manage risk
Please complete the following activities and hand in to your trainer for marking. This forms part of
your assessment for BSBRSK501: Manage risk.
Name: _____________________________________________________________
Address: _____________________________________________________________
_____________________________________________________________
Email: _____________________________________________________________
Employer: _____________________________________________________________
Declaration
I declare that no part of this assessment has been copied from another person’s work with the
exception of where I have listed or referenced documents or work and that no part of this
assessment has been written for me by another person.
Signed: ____________________________________________________________
Date: ____________________________________________________________
If activities have been completed as part of a small group or in pairs, details of the learners
involved should be provided below:
This activity workbook has been completed by the following persons and we acknowledge that it
was a fair team effort where everyone contributed equally to the work completed. We declare that
no part of this assessment has been copied from another person’s work with the exception of where
we have listed or referenced documents or work and that no part of this assessment has been
written for us by another person.
Learner 1: ____________________________________________________________
Signed: ____________________________________________________________
Learner 2: ____________________________________________________________
Signed: ____________________________________________________________
Learner 3: ____________________________________________________________
Signed: ____________________________________________________________

P a g e | 3
Competency Record to be completed by Assessor
Learner Name: _______________________________________________________
Date of Assessment: _______________________________________________________
The learner has been assessed as competent in the elements and performance criteria and the
evidence has been presented as:
Assessor Initials
Authentic
Valid
Reliable
Current
Sufficient
Learner is deemed: COMPETENT NOT YET COMPETENT (Please circle)
If not yet competent, date for re-assessment: ____________________________________
Comments from Trainer / Assessor:
__________________________________________________________________________________
__________________________________________________________________________________
__________________________________________________________________________________
__________________________________________________________________________________
__________________________________________________________________________________
Assessor Signature: ________________________________________________________

P a g e | 4
Observation/Demonstration
Throughout this unit, you will be expected to show your competency of the elements through
observations or demonstrations. Your instructor will have a list of demonstrations you must
complete or tasks to be observed. The observations and demonstrations will be completed as well as
the activities found in this workbook. An explanation of demonstrations and observations:
Demonstration is off-the-job
A demonstrationwill require:
 Performing a skill or task that is asked of you
 Undertakinga simulation exercise
Observation is on-the-job
The observation will usually require:
 Performing a work based skill or task
 Interaction with colleagues and/or customers
Your instructor will inform you of which one of the above they would like you to do. The
demonstration/observation will cover one of the unit’s elements.
The observation/demonstration will take place either in the workplace or the training environment,
depending on the task to be undertaken and whether it is an observation or demonstration. Your
instructor will ensure you are provided with the correct equipment and/or materials to complete the
task. They will also inform you of how long you have to complete the task.
You should be able to demonstrate you can:
1. Establish risk context
2. Identify risk
3. Analyse risk
4. Select and implement treatments
You will also need to show:
 Reading
 Writing
 Oral communication
 Numeracy
 Navigate the world of work
 Interact with others
 Get the work done

P a g e | 5
Activities
Activity 1.1.1 – 1.1.3
Estimated Time 30 Minutes
Objective To provide you with an opportunity to review organisational processes,
procedures and requirements for undertaking risk management in accordance
with current risk management standards in accordance with current risk
management standards.
Activity Complete the following individually or in a group (as applicable to the specific
activity and the assessment environment):
What is the difference between the new ISO13000 and AS/NZS 4360:2004?
The ISO 31000:2018 help the organizations to increase the possibility of
achieving the targeted objectives improving the identification of the
opportunities and the threats and using of the resources for overcoming the
risk.
The AS/NZS 4360:2004 is a standard adopted by the government of Australia to
provide a guide for the purpose of risk management. The standard also specifies
the elements of the process of risk management.
Briefly outline the legal framework.
The standards would emphasize the development of a guidelines that help in
the integration of managing the risks into the organization. The framework
assures that the process is supportive and effective which means that risk
management would become one of the most important component of
governance, strategy planning, management and reporting process and in
allocating the appropriate resources.
Case study: Christine worked13 hours a day, six days a week for three
months.She noted that the floor was slippery but decided to help a customer
before taking steps to clear the area.By the time that Christine returned to the
area, she had forgotten that the floor was wet.Christine fell and broke her leg.
What unsafe behaviour have you identified here?
Christine had been working for the past three months in the same organization
and it is possible that the rules and the timings of the organization are known to
her. While helping a customer, she had forgotten that the timings and the
working process of the organization. She had accidently walked into that part of

P a g e | 6
the organization which had been cleaned recently.
What could be the impact of Christine’s situation to the organisation?
The organization has to provide medical facilities to the employee, Christine as
she faced the accident and broke her leg in the organization.
What would you do if you took a job as a supervisor and walked into a similar
situation?
As a supervisor, if I had to face similar situation in the organization, I would have
asked the employees to be more careful while walking around the organization
especially when the floor has recently been cleaned. Moreover, I would have
helped the customer myself.

P a g e | 7

P a g e | 8
Activity 1.2.1 – 1.2.3
Estimated Time 30 Minutes
Objective To provide you with an opportunity to determine scope for risk management
processes.
Activity Complete the following individually or in a group (as applicable to the specific
activity and the assessment environment):
Do you believe understanding the different types of risk can assist you in
defining the scope?
Understanding and identifying the different types of the risks that an
organization might face or undergo, helps in defining the scope of risk
management effectively.
When writing the scope, what should the writer consider?
Prior to the defining the scope of risk management, the points that needs to be
considered include the project, goals, objectives andactivities of the
organization. The writer should keep in mind the duration of the projects, the
roles and responsibilities of different departments in an organization.
What needs to be evaluated and why?
Based on your outline in the previous question, use your knowledge of your own
organisation or an organisation that you know, to write a brief scope of risk
management. (Note: if you work or have worked in a large organisation, you can
use this question to write a scope for a project you work on or have worked on)
– In your answer, briefly explain the organisation or project.
In order to formulate the risk management, the following needs to be evaluated
in the beginning.
(a) The process, targeted goals, activities, and the process of working of an
organization,
(b) Duration of the projects that are taken up by the organization
(c) Scope of the activities in order to manage the risks
(d) Function of the departments of theorganization
(e) The dependency of the projects and the other departments of the
organization.

P a g e | 9

P a g e | 10
Activity 1.3.1 – 1.3.4
Estimated Time 30 Minutes
Objective To provide you with an opportunity to identify internal and external
stakeholders and their issues.
Activity Complete the following individually or in a group (as applicable to the specific
activity and the assessment environment):
List three internal stakeholders that you may find in an organisation.
The internal stakeholders are the people who are committed towards serving the
organization. These are the board members, the employees of the organization
and the donors of the organization.
List four external stakeholders that may be associated with an organisation.
The external stakeholders are the people who are mostly impacted by the
functions and working of the departments and of the organization as a whole.
These include the clients or the customers, the partners of the community such as
the shareholders.
Identify three stakeholders and state their objectives towards your organisation
or an example organisation in terms of risk management. Who is your contact
with them and how would they be consulted? What are the recommended
feedback and consultation procedures with them?
(i.e. Supplier believes goods are loaded onto an unsafe delivery dock. How
would they be contacted and their feedback heard?).
The board members play the most important role in the management of the risks
in an organization. In case of break of a fire in an organization, the main role is
played by the board members and the insurance officers. The board members
assess the losses incurred by the organization and the insurance officers are
provide the compensation for the losses.

P a g e | 11
Case study: In recent months, your organisation has grown as demand for the
product has increased. In turn, the number of deliveries from one of your
suppliers has increased. Your organisation has established a strong relationship
with one driver, Nick, and he is the only one able to deliver goods to the
organisation due to the volatility of the goods delivered. Do you believe that the
driver is at risk? Why?
Since the organization depends completely on the new driver, Nick, the driver
might face some risk in the organization. The organization does not want to
depend or hire some other driver and hence Nick has to perform the action of
delivering all the goods to the customers. I this case, the health o the driver might
break down as he has to work for long hours I order to deliver the goods.
What could the impact of the increase of deliveries have on the supplier?
The supplier contacts you and asks you to change your driver policy as the driver
has complained. What is this called? How would you resolve this problem?
The increase in the number of deliveries might create problem for the suppliers.
The suppliers might not be able to provide a lot of supply of the raw materials to
the organization as the production of the organization leaps up beyond the
normal.
The problem of the driver can be resolved by recruiting some more drivers in the
organization so that the pressure of the delivery of the goods will not be a burden
on a single driver.

P a g e | 12

P a g e | 13
Activity 1.4.1
Estimated Time 30 Minutes
Objective To provide you with an opportunity to review political, economic, social, legal,
technological and policy context.
Activity Complete the following individually or in a group (as applicable to the specific
activity and the assessment environment):
Gather into small groups for the following group activity:
Choose an example organisation and make a list of at least one change in the
following areas that will impact on the organisation’s risk management
processes.What steps would you take to ensure that your work area is safe in
regards to risk?
The areas are:
 Political: The legislative laws should be changed. A non-discriminatory
law should be enacted within the organization so that it is easy to
manage the risks.
 Economic: in the economic field, the organization can limit their
expenses in some fields so that there are some savings that can be used
during crisis situation or when the organization faces some risk.
 Social: The organization can take help from the community who are
expert in risk management and can provide better advice on risk
management.
 Legal: The organization must adapt itself to the laws such as non-
discrimination of the workers. The organization should also look after
the fact that the workers are motivated and they do not face any kind of
humiliation within the organization.

P a g e | 14
 Technological: The organization should implement the advance
technological measures within it so that they are alert before there is
occurrence of any kind of risks within it.
 The policy context

P a g e | 15
Activity 1.5.1 – 1.5.2
Estimated Time 30 Minutes
Objective To provide you with an opportunity to review strengths and weaknesses of
existing arrangements.
Activity Complete the following individually or in a group (as applicable to the specific
activity and the assessment environment):
Complete a SWOT analysis of an organisation that you know well.
Strengths: The Cole Australia have acquired many customers and share in the
market due to their long history of existence in Australia. The organization has
the strongest presence of advertising and brand value in the retail markets of
the country.
Weakness:The organization have negative publicity and unfair negotiations with
the Australian suppliers. Coles generally operates on the lower margins.
Opportunities:the organization has an opportunity to capture more market and
the supply chain so that it can operate in a more competitive level.
Threats:There is intense competition in the market in which theorganisation is
unable to sustain itself. The consumers of the organization re often found to be
confusedbetween the different brands as there is lack of communication among
them.
Is the organisation internally or externally driven?Why?
The organization in discussion is internally driven in which the employees
motivate themselves but the management of the organization does not
motivate the employees.

P a g e | 16

P a g e | 17
Activity 1.6.1 - 1.8.1
Estimated Time 30 Minutes
Objective To provide you with an opportunity to document critical success factors, goals
or objectives for area included in scope; obtain support for risk management
activities; and communicate with relevant parties about the risk management
process and invite participation.
Activity Complete the following individually or in a group (as applicable to the specific
activity and the assessment environment):
Use the following critical success factors anddocument how you would ensure
that your organisation’s (or example organisation’s) performance improves.The
CSFs are:
 Trust: The leader musthave trust on their employees that they are honest
and would follow though the spoken words. The leader must believe in
the employees. They mustbelieve that the employees of the organization
has the capacity of performing better.
 Organisational culture: The organization must follow the process of
identification of the people who does not match the culture of the
organization and the leaders should come up with a proper plan of action
in order to solve the problem.
 Management support: The management of the organization or the
company must motivate the employees of the company to perform
better. This can be done through proper reward system.
 Communication: There should be effective mode and methods of
communication among the employees in an organization. The leaders and
the management of the organization must also communicate with each
other so that the areas of the problems can be identified and mitigated.

P a g e | 18
 How can you know if you have handled the CSFs correctly?
The organization will have proper communication with each other and the work
and other functions of the organization can be carried out in harmony. There will
be improvement in the organization and the people will be discussing about their
problems.
 For one of the CSFs ask the relevant personnel (or trainer, if not working
for an organisation) for support in managing associated risks and briefly
document this.
In case the improvement of the organization does not take place, it is
better to communicate directly with the human resource manager.
 Discuss the associated risks for the CSF as mentioned in the last
question with those involved, or with two other persons from your
training group and note the outcome of this.
The over trusting of the people in an organization might result in getting cheated.
The culture of the employees might not meet with the culture of the organization.
In such a case, if plan of action is taken or a wrong action is taken, there might be
high turnover in the organization. Provided that the employees does not get any
motivation and reward from the organization, the employees would lose their
interest in their work. Lack of communication in an organization does not help in
the solving of the problem.

P a g e | 19
Activity 2.1.1 – 2.3.1
Estimated Time 30 Minutes
Objective To provide you with an opportunity to identify risks.
Activity Complete the following individually or in a group (as applicable to the specific
activity and the assessment environment):
Identify a risk in your work area or example work area (this can be a possible
risk if there are no risks requiring improvement).
What is the risk?
The losing of important documents and data from the computers of the
accounting department due to virus attack.
Provide details of the problem.
The employees were found to use a corrupted version of the operating system
which has infected the virus in the system. As a result, all the important
documents and data were deleted.

P a g e | 20
Who would you discuss this problem with?
The problem that has occurred are firstly conducted to the management of the
organization and to the experts who can handle the computers and other
systems associated with it.
What type of research would you do to measure the level of risk?
Quantitative research methods are followed in order to conduct the research on
the problem. This system of research involves selecting a sample, forming a
questionnaire and conducting the research.
What documentation could you use?
The risk assessment plans that are formulated by the organization fall under the
legal proceedings of the government.
What literature would you research?
Both the primary and the secondary literature would be researched in order to
solve the problem that has arose within the organization.

P a g e | 21
Invite other members of your team/training group to also help identify any
risks and note down the outcome of this.
The organization might face major break down of fire. In this case, there might
be loses in the organization.
Consultation is an important part of the risk analysis; in what ways can you
gather information from stakeholders in this instance?
The stakeholders like the insurance officers can provide certain information to
the management of the organizations. The consultation with different people
provide the organization with different useful knowledge.

P a g e | 22
Activity 3.1.1 – 3.3.2
Estimated Time 45 Minutes
Objective To provide you with an opportunity to analyse risks.
Activity Complete the following individually or in a group (as applicable to the specific
activity and the assessment environment):
Complete a risk assessment using the risk/research from Activity 2.1.1-2.3.1.
Assess the risk
The organization has faced a loss of documents and important data as a corrupted
version of the operating system has been used.
What is the likelihood of this problem arising again?
The problem or the risk is very likely occur again in the future since the computers
can be hacked or the data might go in the wrong hands.
What are the possible consequences of this risk?
The employees might get fired due to the usage of the corrupted version of the
operating system.
Evaluate and prioritise risks for treatment?
The risks that should be prioritized for treatment are the
i. Use of the corrupted version of the operating system
ii. Non detectable virus attack
iii. Loss of important data
iv. Possibility of power cut
v. Possibility of short circuit within the system.

P a g e | 23
What risk priority would you consider?
The usage of the corrupted system is the first risk and the recovery of the lost
documents would be given priority.
What opportunities do you think there are in your case?How can these
opportunities be used?
The experts and the management should check whether the operating systems
that are being used by the employees are authentic in nature.

P a g e | 24

P a g e | 25
Activity 4.1.1 – 4.1.2
Estimated Time 30 Minutes
Objective To provide you with an opportunity to determine and select the most
appropriate optionsfor treating risks.
Activity Complete the following individually or in a group (as applicable to the specific
activity and the assessment environment):
Use the Hierarchy of Control Pyramid to identify ways in which to eliminate,
control or minimise the hazard used in the Activity 2.1.1-2.3.1 and 3.1.1-3.3.2:
Suggest at least one way of handling the risk for each step of the process:
 Elimination: Proper inspection of the operating sytemand the anti virus
 Substitute or modify: Identify whether the system installed o modified
is authentic of use.
 Isolate: Keeping a track of the importan data and keeping it safely so
that it does not get lost
 Engineering controls: Ensuring the proper functioning of the system
 Administration controls: The system or the computers should be
protected by passwords that are known only to the employees and
adminstrations.
 PPE: The employees should be given a training rgarding the safety rules
while working.
What control would you recommend? Why?
The organization in discussion must control the flow of mails that are mostly
affected by virus and hamper the important documents.

P a g e | 26

P a g e | 27
Activity 4.2.1 – 4.3.1
Estimated Time 30 Minutes
Objective To provide you with an opportunity to develop an action plan for
implementing risk treatment; and communicate risk management processes to
relevant parties.
Activity Complete the following individually or in a group (as applicable to the specific
activity and the assessment environment):
Briefly explain the risk action plan for this assessment.
The risk action plan that is taken into account are the
Risk Avoidance Plan
Risk Reduction Plans
Group activity; in groups of three/four, take turns in briefly discussing your
risk action plan.

P a g e | 28

P a g e | 29
Activity 4.4.1 – 4.4.2
Estimated Time 30 Minutes
Objective To provide you with an opportunity to ensure all documentation is in order
and appropriately stored.
Activity Complete the following individually or in a group (as applicable to the specific
activity and the assessment environment):
What documentation and records do you think you will need to maintain and
file before, during and after the action plan is implemented?
The organization must keep a hard copy of the action plan, the laws by the
government and the legal documents.
Why do you need to keep documentation?
It is important to keep documents so that if the important documents and the
data are lost it can be recovered. Moreover, the legal documents help in the
protection of the organization from long paper works.

P a g e | 30

P a g e | 31
Activity 4.5.1 – 4.5.2
Estimated Time 30 Minutes
Objective To provide you with an opportunity to implement and monitor an action plan.
Activity Complete the following individually or in a group (as applicable to the specific
activity and the assessment environment):
You need to be able to implement the action plan. What do you need to do?
Briefly outline how you would implement each step.
How often will you communicate with stakeholders?
The stakeholders need to be contacted on a regular basis so as to assess he risk.
How would you monitor the effectiveness of your action plan?
The action plans are formulated in order to reduce the risk of the organization.
The organization should be able to mitigate the risk if an action plan is
effectively formulated.

P a g e | 32

P a g e | 33
Activity 4.6.1
Estimated Time 30 Minutes
Objective To provide you with an opportunity to evaluate risk management processes.
Activity Complete the following individually or in a group (as applicable to the specific
activity and the assessment environment):
How will you evaluate your case?Develop a tool that you can use to perform
this task.
Solution Implementation Outcome Risk
The assessment
of the operating
system and
creating
passwords
The solution has
been
implemented by
the experts of
the organization
Reduction in the
risk of loss o
data.
Employees might
not like that they
their laptops or
computers are
being password
protected.

P a g e | 34

P a g e | 35
Skills and Knowledge Activity
Estimated Time 1 Hour
Objective To provide you with an opportunity to demonstrate your knowledge of the
foundation skills, knowledge evidence and performance evidence.
Activity Complete the following individually and attach your completed work to your
workbook.
The answers to the following questions will enable you to demonstrate your
knowledge of:
 Reading
 Writing
 Oral communication
 Numeracy
 Navigating the world of work
 Interacting with others
 Getting the work done
Create and present a presentation detailing:
 The 5 steps for implementation of AS/NZS ISO 31000:2009 Risk
Management – Principles and Guidelines
 The difference between the Act, regulations and codes of practice
 Your organisations policies and procedures regarding risk management
 How your risk management can be adjusted to incorporate disabled
stakeholders
 How risk management plans can be monitored
 How risk management plans are communicated to stakeholders

P a g e | 36
MajorActivity
Estimated Time 1 - 2 Hours
Objective To provide you with an opportunity to demonstrate your knowledge of the
entire unit.
Activity This is a major activity – your instructor will let you know whether you will
complete it during class or in your own time.
Attach your completed answers to the workbook.
You must individually, answer the following questions in full to show your
competency of each element:
1. Establish risk context
2. Identify risk
3. Analyse risk
4. Select and implement treatments
Complete the following and present it as a portfolio:
For this project you may use the following scenario or you can choose a risk
that you are familiar with in your workplace. What you must be able to do is
identify and describe in each step of the process the influence the
organisation's policies, processes and procedures throughout your answers –
this will allow you to demonstrate your understanding of the risk management
process.
If you are not employed, use a former employer and if you have never worked
in the workforce, use the knowledge and legislation within your learner guide
and refer to it where necessary in each question.
If you are using your own case, briefly outline the scenario.
The employees were found to use a corrupted version of the operating system
which has infected the virus in the system. As a result, all the important
documents and data were deleted.
1. What part/s of the legal framework will impact on this risk?
The standards would emphasize the development of a guidelines that help in
the integration of managing the risks into the organization. The framework
assures that the process is supportive and effective which means that risk
management would become one of the most important component of
governance, strategy planning, management and reporting process and in
allocating the appropriate resources.
2. What standard applies presently?
The international body of ISO is charged with achieving standardization o set
out and achieve consistency and reliability in order to manage the risks. A

P a g e | 37
standard that has been formulated includes the following:
i. A set of vocabulary;
ii. A set of criteria of the performance of business
iii. A common process in order to identify, analyse, evaluate and treat
the risk that have occurred.
iv. Guidance on the ways and the process of implementation.
3. What areas does your risk address? (e.g. commercial relationships)
The risk of the loss of data due to the use of the corrupted operating
system not only affected the organization badly but also affected the
relationships with other organizations such as the insurance
organization.
4. There are different types of risk, including legal, financial and safety risk.
Which one/s do you think apply in your case?
The risk that has been discussed is a operational risk which is a type of
financial risk.
5. Who is responsible for this risk?
The management and the computer experts are mostly responsible for the
risk.
6. Who are your external and internal stakeholders?What are their
objectives?
In any organization, internal stakeholders include the board members, staff,
volunteers and the donors while the external stake holders include the
clients, the community partners and the government of the state.
7. Review any political, legal, social, economic or technological changes that
will influence you. Create a SWOT analysis of this.
The operating system and the anti-virus should be assessed prior to the
installation of the same.
8. Outline how critical success factors will influence this case.
The employees will form a team and work on the lost data. A decision would be
taken to analyse the cause of the problem and involve the employees to provide
feedback.
9. Using the stakeholders identified earlier, identify how you would
communicate and consult with each party changes?
Theinternal stakeholders can be communicated face to face within the
organization while the external stakeholders would be communicated
through emails, business letters and memos.
10. What other research would you need to do in this case?
Survey research and collecting thee data of the similar case. Case files of the
earlier and reported case would also help.
In this next section, you may choose to complete a risk assessment form
internal to your organisation if you wish.

P a g e | 38
11. Assess the risk
The loss of data and the termination of the employees for using an outdated
and corrupted version of the operating system. The organization has to
employ new employees so that the faults can be recovered and ensure that
does not take place again.
12. What is the likelihood of this problem arising again?
It is possible that the same problem can arise again in the future if the
measures are not taken seriously.
13. What are the possible consequences of this risk?
As a corrupted operating system is being used, there is more chances that there
will loss of the major and the most important data from the computers or the
laptops that are being used in order to keep the records.
14. Evaluate and prioritisetreatment for the risks?
It is the duty of the management and the higher authority of the organization to
check regularly if there are viruses that have attacked the operating systems
that are being used. The management and the experts of the operating systems
should ensure that the anti-virus that has been installed is the original version
and will not hamper or disturb the working of the computer.
15. What risk priority would you consider?
The following are priority risks:
i. Loss of important data from the databases of the organization.
ii. Termination of the employees for using the corrupted version of the
operating system.
iii. Short circuit
16. What opportunities do you think there are in your case?How can these
opportunities be used?
There are opportunities that can protect from the occurrence of such cases.
The management and the computer experts can use the recent and updated
versions of anti-virus.
17. Based on your assessment and research, list the ways in which you can
minimise the risk.Choose the risk option that you believe is correct.Which
one is it?
In order to reduce the risk in the future, the operating system and all other
software and hardware should be properly scanned so as to avoid the
installation of outdated and corrupted version of the software.
18. Briefly explain the risk action plan for this assessment.
Solution Implementation Outcome Risk
The assessment
of the operating
system and
creating
passwords
The solution has
been
implemented by
the experts of
the organization
Reduction in the
risk of loss of
data.
Employees might
not like that they
their laptops or
computers are
being password
protected.
19. What documentation and records do you think you will need to maintain
and file before, during and after the action plan is implemented?
Prior to the implementation of the action pan, the documentation that is
required include the copy the statement of the document that have been
planned which include the cases of the business, the project plans and other
related approvals. The benchmarks that have been agreed upon such as the

P a g e | 39
technical specifications and other supporting assessments also have to be
submitted.
20. Why do you need to keep documentation?
Documentation is needed to be kept in order to produce the ideas for the
design while development is brought about in an organization.
21. You need to be able to implement the action plan. What do you need to
do? Briefly outline how you will implement each step.
22. How often will you communicate with stakeholders?
The stakeholders, especially the internal stakeholders need to
communicated at least once in a week, beyond this the can be as per
the needs of the organization.
23. How will you evaluate your case?Develop a tool that you can use to
perform this task.
A risk manage plan is the best to assess the case and solve the task.