What is the scheme for classifying sources and categories of risk that provides a common language for discussing and communicating risk to stakeholders?

What is the scheme for classifying sources and categories of risk that provides a common language for discussing and communicating risk to stakeholders?

• A. Risk taxonomy
• B. Risk scenario
• C. Schedule risk
• D. Threat actor

Answer: (A)

A risk taxonomy provides a structured scheme for classifying sources and categories of risk, giving everyone a common language for discussing risk with stakeholders. It organizes risk by sources (such as internal versus external) and by categories (like operational, financial, regulatory, or reputational), along with the potential effects or outcomes. This standardized framework makes risk information easier to describe, compare, and aggregate across projects and levels of the organization, which improves communication, reporting, and prioritization with executives and other stakeholders. The other terms describe different ideas: a risk scenario is a specific, plausible event and its consequences used for analysis; schedule risk focuses on timing and project deadlines; and a threat actor is the entity that could cause harm, which is a component within risk but not a classification framework for risks.

A risk taxonomy provides a structured scheme for classifying sources and categories of risk, giving everyone a common language for discussing risk with stakeholders. It organizes risk by sources (such as internal versus external) and by categories (like operational, financial, regulatory, or reputational), along with the potential effects or outcomes. This standardized framework makes risk information easier to describe, compare, and aggregate across projects and levels of the organization, which improves communication, reporting, and prioritization with executives and other stakeholders. The other terms describe different ideas: a risk scenario is a specific, plausible event and its consequences used for analysis; schedule risk focuses on timing and project deadlines; and a threat actor is the entity that could cause harm, which is a component within risk but not a classification framework for risks.