Final answer:
The statement is false; a risk does not have to have both a high probability and a high impact to be considered in a risk response plan. All identified risks should be evaluated and a response plan could include avoiding, mitigating, transferring, or accepting the risk, in accordance with its assessed impact and likelihood.
Step-by-step explanation:
The statement that a risk response plan candidate is a risk that should have a high probability of occurring and a high impact is False. Risks identified for a risk response plan include those that may have a high probability of occurring, a high impact, or both. However, all identified risks, regardless of their probability and impact, should be considered for a risk response plan. A risk with a low probability but high impact may still be significant enough to warrant a planned response. Additionally, the goal of a risk response plan is to outline proactive strategies for all identified risks, which may include avoiding, transferring, mitigating, or accepting the risks based on their impact and probability.
According to Figure 20.1, Plan B is more conservative and aims at mitigating a high-impact threat, even if its occurrence is uncertain. Plan A is taken when the threat is believed to be unlikely. This illustrates the concept of asymmetric risk, where the consequences of not planning for a severe threat are far greater than the inconvenience of a conservative strategy that may turn out to be unnecessary. Therefore, a risk does not need to have both a high probability and a high impact to be included in a risk response plan; it is the evaluation of the risk's characteristics that determines the appropriate response.