Risk Management and Business Continuity
5
Control Hierarchy
Elimination substitution engineering admin PPE
4
Risk Strategies
Avoid mitigate transfer accept
3
BCP Components
Assessment recovery testing
Hierarchy of Controls
from most effective to least effectivePPE is the LEAST effective control because it does not eliminate the hazard
Elimination
MOST EFFECTIVE
Substitution
Engineering Controls
Administrative Controls
PPE
LEAST EFFECTIVE
Risk Treatment Strategies
Avoid
Eliminate the activity that creates the risk entirely
Mitigate
Reduce the probability or impact of the risk through controls
Transfer
Shift the financial impact to a third party through insurance or outsourcing
Accept
Acknowledge the risk exists and choose to proceed without additional action
Business Continuity Planning
A business continuity plan ensures the organization can maintain essential functions during and after a disaster. It starts with a risk assessment, moves to recovery strategies, and must be tested regularly. A plan that sits on a shelf untested is not a plan.
Risk Assessment
Identify threats, vulnerabilities, and the impact on business operations
Recovery Strategies
Define how critical functions will continue and in what order they will be restored
Testing and Exercises
Run tabletop exercises and simulations to validate the plan works before a real event
want to test yourself on this?
Practice questions on the hierarchy of controls and risk management with instant feedback
Practice NowExam Traps
PPE Is the LEAST Effective Control
PPE protects the individual but does nothing to eliminate the hazard itself. The exam will offer PPE as a tempting answer. Choose elimination or engineering controls when available.
Elimination or Engineering First
When a question asks for the most effective control, always look for elimination first. If elimination is not an option, engineering controls are next. Administrative controls and PPE are lower in the hierarchy.
Risk Transfer Shifts, It Does Not Eliminate
Buying insurance or outsourcing a function transfers the financial impact of a risk. The risk itself still exists. The exam tests whether you understand that transferring risk is not the same as removing it.
PPE Last, Always
Personal protective equipment is the last line of defense. It does not fix the problem. It just protects one person at a time.
Transfer ≠ Eliminate
Insurance transfers risk to the insurer. The hazard still exists. Outsourcing transfers responsibility. The risk still exists.
Remove the knife from the kitchen entirely. No knife, no cut. This is the most effective control because the hazard no longer exists.
Replace the sharp chef knife with a safer food processor. The task still gets done, but with a less dangerous tool.
Add a blade guard to the knife. The hazard is still there, but a physical barrier reduces the chance of injury.
Administrative controls are like a training video on knife safety. PPE is a cut-resistant glove. Both depend on the person actually following through, which is why they are the weakest.
Ready to test your SHRM-CP knowledge?
1,200+ practice questions written by certified professionals.
Start Practicing SHRM-CP