An organization rates a deepfake call claiming to come from its chief executive as medium likelihood and high impact. Explain how it could use that assessment to choose and review controls.

### Why this is right A medium likelihood does not make the risk unimportant when the potential impact is high. The example identifies controls that can help verify requests and prevent one impersonated instruction from authorizing a transaction alone. ### The concept Risk analysis combines likelihood with impact to guide priority. The organization can use independent verification and approval steps to make fraudulent instructions harder to act on. It should document the reasoning and assess existing safeguards rather than assume new controls are effective. Ongoing review matters because attack methods and business processes can change. ### What a good answer covers - Recognize the stated medium likelihood and high impact. - Identify potential financial and reputational consequences. - Name relevant verification and approval controls from the lesson. - Include documentation, review, and ongoing assessment. ### Terms - **Deepfake**: artificially generated or altered media intended to imitate a real person. - **Multi-person approval**: a process requiring more than one person to authorize an action. ### Remember A risk with high impact can deserve strong treatment even when likelihood is not rated high.