A retail firm houses large amounts of customer credit card data in its systems. It will have a higher likelihood of which risk type from external…

The scenario describes a threat from external forces attempting to access sensitive credit card data. This is the specific definition of a cyber threat. The risk that this threat will be successful, leading to a data breach and subsequent losses, is most accurately classified as cyber risk. While a successful attack is a type of operational failure and will certainly cause reputational damage, cyber risk is the most precise and direct term for the risk associated with the failure of information technology systems due to malicious external actors.

A. Liquidity risk: This is a secondary financial risk that might arise from the costs of a data breach (fines, lawsuits), not the primary risk from the attack itself.

B. Operational risk: This is a very broad category of risk. While cyber risk is a component of operational risk, "cyber risk" is the more specific and appropriate answer for this scenario.

D. Reputational risk: This is a significant consequence or outcome of a data breach, rather than the classification of the risk event itself.

1. Association for Financial Professionals (AFP). (2021). Essentials of Treasury Management (6th ed.).

Page 3.21

Chapter 3

"Risk Management": Defines cybersecurity risk as "the risk of loss or damage to an organization resulting from a cyberattack or data breach." This directly maps to the scenario of external forces trying to access data.

Page 3.20

Chapter 3

"Risk Management": Defines operational risk as the "risk of loss resulting from inadequate or failed internal processes

people

and systems

or from external events." This shows that operational risk is a broad category under which the more specific cyber risk falls.

Page 3.23

Chapter 3

"Risk Management": Defines reputational risk as the risk that an event will negatively impact a company's reputation

identifying it as a consequence of other risk events

such as a data breach.