At a county board workshop, three people mention phishing in the same hour, so the facilitator labels phishing 'high likelihood.' What mistake does this reflect?
Select an answer to reveal the explanation.
Short Explanation
Hearing a risk three times in a meeting is not the same as it being likely to happen. Popularity is chatter; likelihood is chance of occurrence. Score probability from evidence, not from who talked the loudest.
Full Explanation
Likelihood should reflect the probability an event occurs or affects objectives—not how often the topic is mentioned in a meeting. Labeling phishing "high likelihood" because three people raised it in a county board workshop confuses discussion frequency with occurrence probability. Using vendor patch notes only for consequence is a different issue; the stem's error is discussion-as-likelihood. Requiring identical residual ratings after insurance purchases collapses evaluation. Banning qualitative scales whenever stakeholders speak is unrelated theater. Exam caveat: salience in conversation ≠ likelihood on the scale. Operational check: score phishing with evidence such as observed click rates, simulated-phish results, threat intel, or exposure counts—not hand-raise counts—and document the evidence line on the civic register. Retrain facilitators to separate brainstorming volume from probability scoring. In municipal practice, record the rationale in the risk procedure or committee minutes so future staff apply the same rule under budget pressure. Re-validate after the next seasonal peak or org-chart change to confirm the civic control still holds as designed for residents and staff.