What is the term for determining how often a particular risk scenario might be expected to occur during a specified period of time?

• A. Frequency analysis
• B. Control risk self-assessment
• C. Business impact
• D. Control owner

Answer: (A)

Estimating how often a risk scenario occurs within a specified period centers on frequency—the expected rate of occurrence. By examining historical incident data, trends, or expert judgment, you assign a likelihood per time unit (such as per year). This frequency helps quantify risk when combined with impact, guiding decisions about controls, monitoring, and resource allocation. The other terms describe different aspects: business impact is about consequences, control owner is the person responsible for a control, and a control risk self-assessment is the process of evaluating control effectiveness, not the occurrence rate.