1. In the context of third-party risk management, what does the term "four eyes principle" refer to?

2. Which of the following is NOT a typical component of third-party risk management?

3. What role does continuous monitoring play in third-party risk management?

4. Which of the following is NOT a category of third-party risk?

5. ___________ is described as “the amount of risk that an organization is willing to accept to achieve its objectives.”

6. Which of the following controls is an example of non-technical controls?

7. Which of the following risk management roles is part of first line of defense?

8. True or False:

Inherent risk is current risk level given the existing set of controls rather than the hypothetical notion of an absence of any controls.

Residual risk would then be whatever risk level remain after additional controls are applied.

9. According to the three lines of defense model, where would the data ethics function MOST likely reside in an enterprise?

10. What is the key difference between qualitative and quantitative risk analysis?

11. What is the purpose of a risk register?

12. In the risk management process, what does the term "mitigation" refer to?

13. What does the acronym "SWOT" stand for in risk analysis?

14. What is the difference between a risk and an issue in project management?

15. Which type of risk refers to the potential loss of data due to unauthorized access or cyberattacks?