EXIN Foundation in IT Service Management based on ISO/IEC 20000 — Question 10

During a risk analysis a system administrator mentions that due to the lack of communication between Human recourses management (HRM) and system administrators, employees can still access the company server from home even if they are no longer employed by the company.
Which characteristic of a risk is missing here?

Answer options

• A. Business impact
• B. Security control
• C. Threat agent
• D. Vulnerability

Correct answer: A

Explanation

The correct answer is A, as the business impact reflects the consequences of unauthorized access by former employees. Options B, C, and D do not directly address the result of this communication gap, which is the potential harm to the organization due to the continuing access of ex-employees.