Which principle states that a small subset of risks accounts for most impact, guiding prioritization in risk management?

• A. 80/20 rule; a small subset of risks typically accounts for most impact, guiding prioritization.
• B. The law that all risks can be eliminated with enough controls.
• C. The concept that risk impact is evenly distributed across risks.
• D. The idea that only financial risks matter.

Answer: (A)

The 80/20 rule in risk management says that a small subset of risks accounts for most impact, guiding prioritization. This means focus your mitigation efforts on the few risks that would drive the largest losses or disruptions, because addressing those yields the biggest reduction in overall risk for the effort spent. In practice you identify which risks contribute most to the risk profile—through risk scoring, Pareto analysis, or criticality assessments—and allocate resources accordingly. For example, in a project, a handful of failure modes might dominate the chances of delays or cost overruns, so tackling those first makes the biggest difference in resilience. The other ideas don’t fit because it’s not realistic to assume all risks can be eliminated with enough controls, and risk impact isn’t evenly distributed—some risks clearly have outsized effects. It’s also not limited to financial risks; non-financial risks like operational, strategic, or reputational factors can be just as impactful.