Credit Union Management School (CMS) Year 3 Practice Test

Impact measures the potential financial consequence if a risk event occurs and no response actions are taken. It focuses on the effect on net income (or other financial outcomes) if the exposure materializes without mitigations. This is why option describing the potential effect on net income in the absence of responses is correct. It differs from probability, which is about how likely the event is to occur, and from actions taken to mitigate or reduce risk, which are responses rather than the consequence itself. In risk assessment, both likelihood and impact are used together to prioritize risks and determine where to allocate controls and resources. For example, a data breach could have a large impact on net income even if its probability is moderate; that potential financial loss is what impact captures.