Topics in this domain
- Risk Response Options: Accept, Mitigate, Transfer, Avoid
- Aligning Responses with Appetite and Tolerance
- Cost-Benefit Analysis of Risk Responses
- Bias in Risk Decisions and Reporting
- Risk Owners and Control Owners
- RACI and Escalation
- Third-Party Risk Governance and Due Diligence
- Contracts, SLAs and the Right to Audit
- Monitoring Third Parties and Planning Exit
- Managing Issues, Findings and Control Deviations
- Risk Acceptance, Exceptions and Exemptions
- Control Frameworks and Their Purpose
- Control Types and Functions
- Designing and Selecting Controls
- Implementing Controls and Why Implementations Fail
- Control Design versus Operating Effectiveness
- Control Testing: Objectives, Evidence and Frequency
- Building and Tracking Risk Action Plans
- Collecting and Aggregating Risk Data
- Validating Risk Data Quality
- KRIs, KPIs and KCIs
- Thresholds, Escalation Triggers and Appetite
- Metric Pitfalls and Misuse
- Continuous Monitoring versus Periodic Assessment
- Tailoring Risk Reports to the Audience
- Heat Maps, Dashboards and Scorecards
- Identifying and Assessing Emerging Risks
- Integrating Emerging Risk into Decisions
Bias in Risk Decisions and Reporting
Biases to watch
Where bias creeps in
| Stage | How bias shows up |
|---|---|
| Estimating | Optimistic likelihoods; anchoring on the first number |
| Choosing responses | Favouring familiar controls; sunk cost |
| Reporting | Selective data, softened wording, misleading scales |
Countering bias
- Collect independent estimates before discussion.
- Use incident and industry data as a check.
- Ask what evidence would change the conclusion.
- Invite challenge from people outside the team.
- Use the same scales and periods in every report.
Example. In a workshop, the CIO said ransomware was “very unlikely here”, and nobody disagreed. A follow-up anonymous estimate showed most participants rated it likely. The scenario was re-rated and treated.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Reduce groupthink in estimates | Anonymous methods such as Delphi |
| Project continues because of money spent | Sunk cost bias; judge future value |
| BEST check on optimistic estimates | Incident and industry data |
| Report hides an unfavourable trend | Present complete, consistent data |
In short
- Common biases include optimism, anchoring, confirmation, availability, groupthink and sunk cost.
- Bias affects estimates, the choice of response and how risk is reported.
- Structured methods, data and independent challenge reduce bias.
- Anonymous estimation such as Delphi reduces anchoring and groupthink.
- Reports can be biased by selective data, misleading scales or softened wording.
Exam traps
- Assuming experienced people aren't biased.
- Letting the most senior person speak first in estimation workshops.
- Continuing a project because of money already spent.
- Rating a risk higher simply because a similar incident was in the news.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Biases to watch
1 / 7