問題文
During assessment, a practitioner estimates that a scenario has a low likelihood but would breach a regulatory obligation if it occurred. How should this be reflected in the assessment?
選択肢
- Record it as a compliance issue rather than a risk.
- Reduce the recorded impact in proportion to the low likelihood so that the register holds a single figure for the expected loss.
- Record the impact against the enterprise's impact criteria which should treat a regulatory breach as a distinct category rather than converting it into money.
- Exclude the scenario from the register because its likelihood is below the enterprise's threshold for recording risks and revisit it only if the likelihood estimate increases in a later assessment cycle.