Ethics, Inclusion, Governance and Communication Risk

Introduction

International business depends on communication across legal systems, languages, technologies and cultures. A message sent by a manager in one country may be interpreted by employees, regulators, customers, investors and communities in many others. Communication therefore creates value, but it also creates risk. An inaccurate public statement can mislead investors; an apparently harmless joke can exclude a cultural or social group; an uncontrolled disclosure can breach privacy or commercial confidentiality; and an AI-generated translation can reproduce bias or invent facts.

Ethical communication is not simply a matter of being polite. It concerns the responsible exercise of organizational power. Organizations decide what to disclose, what to withhold, whose voice is heard, which groups receive access, and how uncertainty is represented. Governance provides the structures through which those decisions are authorized, monitored and corrected.

This chapter examines truthfulness, transparency, confidentiality, privacy, intellectual property, discrimination, accessibility and misinformation. It then applies these ideas to stakeholder communication, crisis communication and intercultural communication. The central argument is that communication risk should be managed as a strategic governance issue rather than treated as an isolated public-relations problem.

Learning Objectives

By the end of this chapter, students should be able to:

1. Distinguish truthfulness, transparency, confidentiality, privacy and intellectual property.
2. Evaluate communication decisions using ethical and governance principles.
3. Identify discriminatory, inaccessible and culturally unsafe communication.
4. Explain how misinformation and disinformation create organizational risk.
5. Apply a structured process to stakeholder, crisis and intercultural communication.
6. Recommend controls for human and AI-assisted communication.
7. Analyse a communication case and justify an ethically defensible response.

1. Communication as an Ethical and Governance Activity

1.1 Ethics, compliance and governance

Ethics concerns what an organization ought to do, including situations where the law is silent or ambiguous. Compliance concerns adherence to applicable laws, regulations, contracts and internal rules. Governance concerns the allocation of authority, accountability and oversight.

These concepts overlap but are not identical. A message may be legally permissible yet ethically misleading. Conversely, an ethical commitment may require an organization to exceed minimum legal requirements. For example, a company might be legally permitted to use complex contractual language while still having an ethical responsibility to communicate key risks in plain language.

A useful governance chain is:

Purpose → authority → decision → communication → monitoring → correction

The organization should know why a communication is necessary, who is authorized to approve it, what evidence supports it, how it will be delivered, how its effects will be monitored and how errors will be corrected. Weakness at any point increases risk.

1.2 Stakeholders and communication duties

Stakeholders include individuals or groups affected by an organization or able to affect it. Typical stakeholders include employees, customers, suppliers, investors, regulators, local communities, civil-society organizations and business partners. Their information needs differ. Investors may need material financial information; employees may need operational and employment information; communities may need information about environmental or social effects.

A stakeholder approach does not mean that every stakeholder receives every piece of information. It means that decisions about information are made deliberately, fairly and consistently. Relevant questions include:

• Who may be affected by the message or by its omission?
• What information is necessary for informed decision-making?
• What power differences exist between the organization and its audience?
• Could language, disability, technology or cultural assumptions exclude some recipients?
• Who is accountable if the message causes harm?

2. Truthfulness and Transparency

2.1 Truthfulness

Truthfulness requires that communication not contain intentional falsehoods, fabricated evidence or materially misleading omissions. It also requires reasonable care in verifying claims. A statement can be technically true but misleading if it presents a favourable figure without a relevant limitation.

Truthfulness has at least four dimensions:

1. Factual accuracy: claims correspond to reliable evidence.
2. Completeness: material qualifications are not concealed.
3. Proportionality: the prominence of a claim reflects its importance and certainty.
4. Correction: significant errors are acknowledged and corrected promptly.

Truthfulness does not require certainty where certainty is impossible. A responsible communicator distinguishes facts, estimates, forecasts, opinions and unknowns. For example, “sales declined by 8% in the reported quarter” is a factual claim if supported by verified records. “Sales will recover next quarter” is a forecast and should be presented with assumptions and uncertainty.

2.2 Transparency

Transparency is the provision of information about decisions, methods, interests, limitations and accountability. It is not equivalent to total disclosure. Excessive, irrelevant or incomprehensible information can obscure rather than clarify.

Effective transparency is:

• Relevant: focused on information stakeholders need.
• Accessible: understandable and available through appropriate channels.
• Timely: provided early enough to support decisions.
• Traceable: linked to evidence, owners and decision processes.
• Proportionate: balanced against privacy, security and confidentiality.

A practical disclosure test asks: What would a reasonable affected person need to know to make an informed decision? This test is especially important in sustainability claims, product safety, employment changes, data use and financial communication.

2.3 Ethical frameworks for evaluating messages

Several ethical perspectives can assist analysis.

Deontological ethics evaluates duties and principles. A communicator should not lie, exploit confidential information or discriminate, even where doing so might produce a convenient outcome.

Consequentialism evaluates likely outcomes. A disclosure may be justified if it prevents serious harm, but the communicator must consider foreseeable negative effects, including panic, privacy loss or retaliation.

Virtue ethics focuses on character traits such as honesty, courage, fairness, practical wisdom and responsibility. It asks what a trustworthy organization or professional would do.

Justice and stakeholder theories focus on fair treatment, voice and distribution of benefits and burdens. They are particularly useful where communication affects vulnerable groups or communities with limited bargaining power.

In practice, sound governance uses these perspectives together. A decision should be lawful, evidence-based, fair, proportionate and capable of public justification.

3. Confidentiality, Privacy and Intellectual Property

3.1 Confidentiality

Confidentiality is an obligation to protect information from unauthorized disclosure. It may arise from employment duties, contracts, professional standards, trade-secret protection or organizational policy. Confidential information can include prices, formulas, negotiations, customer lists, merger plans, passwords and non-public strategic plans.

Confidentiality is not absolute. Disclosure may be required by law, regulation, court order or a legitimate whistleblowing process. The correct response is not to disclose casually but to consult authorized legal, compliance or ethics channels.

Good controls include classification of information, need-to-know access, secure storage, approval procedures, staff training and documented retention and disposal rules. Employees should also understand that confidentiality continues after a meeting, project or employment relationship ends.

3.2 Privacy

Privacy concerns people’s control over information about themselves and protection against unjustified observation, use or disclosure. Personal data may include names, identification numbers, location information, health details, biometric data, behavioural records and online identifiers, depending on the applicable legal framework.

Responsible privacy communication should explain, in understandable language:

• what data are collected;
• why they are collected;
• the lawful or authorized basis for processing;
• who receives them;
• how long they are retained;
• what rights or choices individuals have; and
• how concerns can be raised.

Organizations should apply data minimization: collect and use only what is reasonably necessary for a defined purpose. They should also distinguish anonymized information, where individuals cannot reasonably be identified, from pseudonymized information, where re-identification may still be possible.

Privacy and confidentiality overlap but are different. Confidentiality protects information entrusted to an organization. Privacy concerns the rights and interests of the individual to whom personal information relates. A company may have confidential business information that is not personal data, and it may hold personal data that must be protected for privacy reasons.

3.3 Intellectual property

Intellectual property includes legal rights associated with creations and distinctive business assets. Common categories include copyright, patents, trademarks, designs and trade secrets. Communication risks arise when employees copy material without permission, use third-party images, reveal inventions before protection is sought, misuse a competitor’s trademark or upload proprietary material to an external AI system.

Ethically responsible practice includes verifying ownership, obtaining licenses, acknowledging sources, respecting usage restrictions and maintaining records of permissions. “Available online” does not mean “free to copy.” Attribution may be ethically important even where a license does not strictly require it, while attribution alone does not replace permission where permission is required.

4. Inclusion, Non-Discrimination and Accessibility

4.1 Inclusion and discrimination

Inclusion means that people can participate meaningfully and are treated with dignity. Discrimination occurs when individuals or groups receive unjustified adverse treatment because of characteristics such as race, ethnicity, nationality, sex, gender, disability, age, religion, sexual orientation or other protected or socially significant attributes.

Communication can discriminate directly through insults, exclusion or unequal access. It can also discriminate indirectly through apparently neutral practices. Examples include scheduling essential meetings at times that systematically exclude a religious group, requiring idiomatic language that disadvantages multilingual employees, using images that portray one nationality as less competent, or evaluating customer complaints differently depending on the perceived identity of the speaker.

A communication audit should examine:

• who is represented and who is absent;
• whether terminology relies on stereotypes;
• whether humour depends on cultural or social discomfort;
• whether translation preserves meaning and dignity;
• whether reporting channels are safe for marginalized groups; and
• whether decision-makers test effects on different populations.

4.2 Accessibility

Accessibility is the design of communication so that people with different abilities, technologies and circumstances can perceive, understand and act on it. It benefits people with disabilities and also supports users in noisy environments, on mobile devices, with limited bandwidth or in a second language.

Good practice includes:

• meaningful headings and logical structure;
• plain language and defined technical terms;
• captions and transcripts for audio-visual material;
• alternative text for informative images;
• sufficient colour contrast;
• keyboard-accessible digital content;
• readable fonts and appropriate spacing;
• translated or interpreted versions where necessary; and
• non-digital alternatives for people who cannot access a platform.

Accessibility should be built into design rather than added after publication. The relevant question is not whether a message was technically posted, but whether intended audiences can actually receive and use it.

5. Misinformation, Disinformation and Malinformation

Misinformation is false or inaccurate information shared without a demonstrated intention to deceive. Disinformation is false or manipulated information deliberately produced or distributed to deceive or cause harm. Malinformation is genuine information used out of context or disclosed maliciously.

Organizations face risks from external campaigns, careless employees, manipulated media, impersonation, fraudulent instructions and inaccurate automated content. False information can damage reputation, influence markets, endanger employees or disrupt supply chains.

A responsible response includes:

1. Detecting the claim and assessing its reach and potential harm.
2. Verifying evidence through authoritative internal and external sources.
3. Identifying whether the issue is error, manipulation, satire, hostile activity or legitimate criticism.
4. Selecting a proportionate response rather than amplifying a minor rumour.
5. Publishing a clear correction, evidence and practical guidance where necessary.
6. Monitoring whether the response reduces confusion.

Corrections should not repeat a false claim more prominently than necessary. Organizations should avoid attacking critics merely because criticism is uncomfortable. Accuracy and legitimacy are strengthened when the organization distinguishes disagreement from demonstrable falsehood.

6. Governance Framework for Communication Risk

A communication-risk framework can be organized into five stages.

Stage 1: Identify

Map the audience, message, channel, information type and possible harms. Ask whether the communication involves personal data, confidential information, intellectual property, regulated claims, vulnerable audiences or cross-border sensitivities.

Stage 2: Assess

Evaluate likelihood and impact. Consider legal, financial, operational, reputational, human and cultural consequences. Also consider reversibility: a mistaken internal email may be corrected, whereas a leaked health record or public accusation may cause enduring harm.

Stage 3: Control

Use controls such as evidence checks, approval thresholds, separation of duties, access restrictions, translation review, accessibility testing, scenario planning and secure channels. High-risk messages should receive stronger review than routine messages.

Stage 4: Communicate

Select a channel and style appropriate to the audience. State what is known, what is uncertain, what action is required and where further information is available. Do not allow urgency to eliminate basic verification.

Stage 5: Monitor and learn

Track questions, complaints, corrections, access barriers and unintended effects. Record incidents and update policies, training and systems. A mature governance culture treats near misses as learning opportunities rather than reasons to conceal problems.

A simple risk-prioritization model may be used for internal triage:

Here, R is a qualitative or semi-quantitative risk score, L is the estimated likelihood of a harmful event, and I is its estimated impact. The model assumes that likelihood and impact are assigned on defined, comparable scales. It is a prioritization aid, not a precise prediction of harm; ethical decisions must also consider rights, vulnerability, legal duties and irreversible consequences.

7. Stakeholder and Crisis Communication

7.1 Stakeholder communication

Stakeholder communication should be matched to legitimate information needs, influence and potential impact. A stakeholder matrix can classify groups by the degree to which they are affected and the degree of influence they possess. However, low-power groups should not be ignored. Communities with limited political influence may still face significant consequences and have strong moral claims to information and participation.

Credible stakeholder communication generally has five characteristics:

• evidence-based claims;
• clear explanation of limitations;
• respect for affected persons;
• opportunities for response; and
• consistency across channels.

Consultation is not meaningful if decisions are already fixed while communication merely creates an appearance of participation.

7.2 Crisis communication

A crisis is an event that threatens important organizational objectives and requires urgent decisions under uncertainty. Crisis communication should protect people first, preserve evidence, coordinate decision-makers and maintain public confidence without making unsupported promises.

An initial statement should normally identify what happened or is being investigated, what the organization is doing, what people should do, what remains unknown and when the next update will occur. It should avoid speculation, blame and premature certainty.

The spokesperson should be trained, authorized and culturally competent. Internal audiences must not learn critical safety information from social media before receiving appropriate internal guidance. Legal review is important, but it should not become an excuse for silence where people need immediate protective information.

8. Intercultural Communication and Ethical Judgment

Culture influences expectations about hierarchy, silence, disagreement, time, emotion, directness and relationship-building. Cultural frameworks can help identify possible differences, but they should not be used to stereotype individuals. National culture does not determine personal behaviour, and organizations contain professional, generational, regional and other subcultures.

Ethical intercultural communication requires cultural humility: recognizing that one’s own norms are partial, asking rather than assuming, and remaining open to correction. Practical techniques include:

• using plain and internationally understandable language;
• avoiding idioms, sarcasm and unexplained metaphors;
• confirming understanding without humiliating the recipient;
• allowing different forms of participation;
• checking how titles, names and pronouns should be used;
• employing qualified translators for high-risk content; and
• separating cultural difference from misconduct.

For example, silence in a meeting may indicate reflection, disagreement, deference or limited language confidence. Treating it automatically as agreement is a governance failure because it may produce an invalid decision.

9. Technology and Artificial Intelligence

Digital tools improve speed, translation, accessibility and audience analysis, but they create new risks. AI systems may generate fabricated citations, reproduce stereotypes, expose confidential prompts, infer sensitive characteristics or produce translations that alter legal meaning. Automated sentiment analysis can also misinterpret multilingual, indirect or culturally specific communication.

Organizations should establish controls including:

• approved tools and prohibited data categories;
• human review for high-impact communication;
• source verification and fact checking;
• disclosure where automation materially affects an interaction;
• records of prompts, outputs and approvals where appropriate;
• privacy and intellectual-property assessment; and
• accessible channels for appeal or correction.

Human review does not mean accepting an AI output after a superficial glance. The reviewer must have the expertise and authority to evaluate accuracy, bias, confidentiality and context. AI can assist communication, but accountability remains with the organization and the responsible decision-maker.

10. Illustrative Case: The Multilingual Product Recall

Background

GlobalHome, a fictional consumer-appliance company, sells a kitchen device in twelve countries. A quality team discovers that a small component can overheat under a rare combination of conditions. The legal team recommends a recall. The communications team prepares an English notice and uses automated translation for eight markets.

Problem

The translated notices use a word equivalent to “minor inconvenience” for a risk that could cause burns. In one country, the message is posted only on the corporate website, although many affected customers purchased through retail partners and have limited internet access. A local manager wants to delay the announcement until replacement parts are available. An employee also uploads the confidential engineering report to a public AI tool to obtain a faster summary.

Analysis

The case contains several connected risks. Truthfulness requires accurate description of the hazard and avoidance of minimizing language. Transparency requires timely information about the affected product, symptoms, corrective action and uncertainty. Accessibility requires channels usable by customers with limited internet access and communication in appropriate languages. Confidentiality and intellectual-property controls were breached when the engineering report was uploaded. Governance failed because translation, channel selection and escalation were not assigned clear approval responsibility.

A purely reputational approach might delay the announcement to protect sales. An ethical and governance approach gives priority to preventing foreseeable physical harm while protecting necessary confidential technical details.

Approach and solution

GlobalHome should immediately establish a cross-functional incident group with quality, legal, communications, customer service, information security and local-market representatives. It should:

1. Verify the affected product range and hazard evidence.
2. Issue a plain-language safety notice that states the risk without exaggeration or minimization.
3. Use qualified human translators and local reviewers.
4. Notify retailers, regulators and customers through websites, email, telephone, point-of-sale notices and other locally effective channels.
5. Provide clear instructions to stop using the product and obtain a remedy.
6. Offer accessible formats and customer support for people with disabilities or limited digital access.
7. Investigate the AI upload, restrict further exposure and follow incident-response procedures.
8. Publish updates as facts develop and correct errors promptly.
9. Document approvals, decisions and lessons for future recalls.

Outcome

The company incurs short-term recall and communication costs but reduces physical harm and demonstrates accountability. Retailers cooperate because they receive clear instructions. The investigation leads to new translation controls, data-handling rules and crisis exercises. The company’s response is not judged solely by whether the defect existed; it is judged by whether the organization acted responsibly once it knew of the risk.

Learning points

The case illustrates that communication risk is inseparable from operational risk. Speed matters, but speed without verification can magnify harm. Confidentiality must be balanced against the duty to warn. Intercultural and accessibility review are not cosmetic additions: they affect whether a safety message is understood and acted upon.

11. Challenges and Limitations

Ethical communication rarely offers a perfect solution. Transparency may conflict with privacy or security. A crisis may require action before all facts are known. Different legal systems may impose inconsistent disclosure duties. Translation may lose nuance despite professional review. Stakeholders may interpret the same message differently because of history, power or mistrust.

Risk matrices can create false confidence if numerical scores conceal uncertainty or unequal harm. Codes of conduct can become symbolic if leaders reward results while ignoring the means used to achieve them. Training alone cannot solve structural problems caused by poor incentives, inaccessible technology or unclear accountability.

Organizations should therefore combine principles with systems: independent oversight, escalation channels, audits, protected reporting, inclusive design, documented decisions and leadership example. Ethical culture is demonstrated by what happens when truth is inconvenient, correction is costly or the affected group has little power.

12. Professional Best Practices

Professionals can use the following checklist before sending a high-consequence message:

1. What decision or action is the message intended to support?
2. Are the facts verified, current and properly qualified?
3. What material information is omitted, and is the omission justified?
4. Does the message contain personal, confidential or protected information?
5. Are permissions, licenses and sources documented?
6. Could the language stereotype, exclude or disadvantage anyone?
7. Can all intended audiences access and understand it?
8. Has the message been reviewed by an appropriate subject-matter expert?
9. Are cultural and translation risks addressed?
10. What happens if the message is forwarded, translated or publicly disclosed?
11. Who owns correction and follow-up?
12. How will the organization know whether the communication worked?

These questions support professional judgment but do not replace legal advice or specialized review where required.

Chapter Summary

Ethical communication is a strategic responsibility involving truthfulness, transparency, fairness, confidentiality, privacy and respect for intellectual property. Truthful communication distinguishes facts from forecasts and corrects material errors. Transparency provides relevant, timely and understandable information while recognizing legitimate limits such as privacy and security.

Inclusion requires active attention to representation, language, cultural assumptions and power. Accessibility ensures that people can perceive, understand and act on communication through appropriate formats and channels. Misinformation, disinformation and malinformation require evidence-based, proportionate responses.

Governance connects communication purpose, authority, controls, monitoring and correction. A structured risk process identifies affected stakeholders, assesses potential harm, applies controls, communicates clearly and learns from outcomes. These principles are especially important in crisis and intercultural communication, where uncertainty, urgency and different expectations increase the possibility of harm. Technology and AI can improve communication, but they also require human accountability, privacy protection, source verification and bias controls.

Key Terms

Ethics: Principles concerning what ought to be done and what constitutes responsible conduct.

Compliance: Adherence to applicable laws, regulations, contracts and organizational rules.

Governance: Structures for authority, accountability, oversight and organizational decision-making.

Truthfulness: Communication that accurately represents evidence and avoids material deception.

Transparency: Provision of relevant information about decisions, methods, limitations and accountability.

Confidentiality: Protection of entrusted information from unauthorized disclosure.

Privacy: Protection of individuals’ control over and interests in information about themselves.

Data minimization: Collection and use of only the personal data reasonably necessary for a defined purpose.

Intellectual property: Legal rights associated with creations, inventions, brands, designs and protected business knowledge.

Inclusion: Meaningful participation and dignified treatment of people with different identities and circumstances.

Discrimination: Unjustified adverse treatment based on a protected or socially significant characteristic.

Accessibility: Design that enables people with different abilities, technologies and circumstances to use communication.

Misinformation: False or inaccurate information shared without demonstrated intent to deceive.

Disinformation: False or manipulated information deliberately distributed to deceive or cause harm.

Malinformation: Genuine information used out of context or disclosed maliciously.

Stakeholder: A person or group affected by, or able to affect, an organization.

Crisis communication: Communication intended to protect people and maintain coordination during a threatening, uncertain event.

Cultural humility: A continuing willingness to question one’s assumptions and learn from people of different backgrounds.

Communication risk: The possibility that a communication decision will cause legal, ethical, operational, financial or reputational harm.

Review Questions

Short Answer Questions

1. How do truthfulness and transparency differ?
2. Why are confidentiality and privacy not identical?
3. Define misinformation, disinformation and malinformation.
4. List four features of accessible communication.
5. Why should AI-generated communication receive human review?

Long Answer Questions

1. Explain how ethical theories can be combined to evaluate a difficult organizational communication decision.
2. Discuss the relationship between communication governance and stakeholder trust.
3. Analyse the ethical tensions between transparency, privacy and confidentiality.
4. Explain how inclusion and intercultural competence improve organizational communication.
5. Describe a comprehensive governance process for crisis communication.

Analytical / Application Questions

1. A company discovers that a supplier has used unauthorized images in an international advertising campaign. Identify the ethical, intellectual-property and governance issues, and recommend a response.
2. An organization publishes an emergency notice only in its headquarters language and through a mobile application. Evaluate the communication risks and design a more inclusive approach.
3. An AI tool produces a persuasive but inaccurate statement about a product safety incident. Apply the five-stage communication-risk framework to determine what the organization should do next.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes transparency from total disclosure?

A. Transparency requires publishing every piece of organizational information.

B. Transparency provides relevant, timely and understandable information while recognizing legitimate limits.

C. Transparency means communicating only information required by law.

D. Transparency is primarily a method of protecting trade secrets.

Correct Answer: B. Transparency provides relevant, timely and understandable information while recognizing legitimate limits.

Question 2

Which practice best demonstrates truthfulness in a forecast?

A. Presenting the forecast as a guaranteed result

B. Removing assumptions to make the message simpler

C. Identifying the forecast as uncertain and explaining its assumptions

D. Using a favourable estimate without stating its source

Correct Answer: C. Identifying the forecast as uncertain and explaining its assumptions

Question 3

What is the principal distinction between confidentiality and privacy?

A. Confidentiality concerns entrusted information, while privacy concerns individuals’ interests in information about themselves.

B. Confidentiality applies only to public information, while privacy applies only to trade secrets.

C. Privacy is voluntary, while confidentiality is always criminally enforced.

D. They are identical concepts with no practical distinction.

Correct Answer: A. Confidentiality concerns entrusted information, while privacy concerns individuals’ interests in information about themselves.

Question 4

Which example illustrates indirect discrimination in communication?

A. Insulting an employee because of nationality

B. Using a qualified interpreter for a safety meeting

C. Scheduling essential meetings at times that systematically exclude a religious group

D. Publishing a transcript alongside a video

Correct Answer: C. Scheduling essential meetings at times that systematically exclude a religious group

Question 5

What is the most appropriate first response to a potentially harmful false claim about an organization?

A. Immediately accuse the source of criminal conduct

B. Verify the claim and assess its reach and potential harm

C. Delete all internal records relating to the claim

D. Repeat the claim prominently without context

Correct Answer: B. Verify the claim and assess its reach and potential harm

Question 6

Which item is part of the communication-risk framework’s control stage?

A. Ignoring uncertainty until the message is published

B. Using approval procedures, access restrictions and accessibility testing

C. Selecting the most entertaining communication channel

D. Replacing evidence with managerial intuition

Correct Answer: B. Using approval procedures, access restrictions and accessibility testing

Question 7

In a crisis, an initial organizational statement should normally include which element?

A. Unsupported promises about the final outcome

B. Speculation about who is legally responsible

C. What is known, what is being done and when further updates will occur

D. Only a denial of liability

Correct Answer: C. What is known, what is being done and when further updates will occur

Question 8

Which practice reflects cultural humility?

A. Assuming all members of a national culture communicate identically

B. Treating silence automatically as agreement

C. Asking about communication preferences and remaining open to correction

D. Using stereotypes to predict negotiation behaviour

Correct Answer: C. Asking about communication preferences and remaining open to correction

Question 9

Why is uploading a confidential engineering report to a public AI tool risky?

A. It guarantees that the report will be translated accurately.

B. It may expose confidential or proprietary information to an unauthorized system.

C. It eliminates all intellectual-property obligations.

D. It prevents the organization from needing human review.

Correct Answer: B. It may expose confidential or proprietary information to an unauthorized system.

Question 10

Which statement about the risk score R = L × I is correct?

A. It is a precise prediction of all future harm.

B. It is a prioritization aid based on estimated likelihood and impact.

C. It applies only when likelihood is zero.

D. It eliminates the need to consider rights and vulnerability.

Correct Answer: B. It is a prioritization aid based on estimated likelihood and impact.