4.2 Contents of a risk management framework

Question 1

The ISO distuinguishes between a risk management f________, p_________ and p______. However, this does not mean that these elements are independent

Answer 1

framework, principles and process

Question 2

At a minimum, a risk management framework for a typical organisation will include mechanisms for:

• i________ of risk
• a__________ of significant of risks
• m_________ to detect changes in risk exposure
• c___________ identified risk exposure

Answer 2

identification
assessment
monitoring
controlling

Question 3

What four verbs make up the risk management process?

Answer 3

Identifying, assessing, monitoring, controlling

Question 4

The ISO 31000 standard talks about three core elements of risk management. What are these?

Answer 4

Architecture (Committees, reporting etc.)
Strategy (policies, appetite, etc.)
Protocols (processes and procedures)

Question 5

An organisation will usually have a risk management policy outlining the following:

• aims and objectives for risk management
• processes, procedures and activities comprising risk management f________
• g_________ arrangements, such as use of a risk committee
• allocation of r______ and responsibilities for risk management.

Answer 5

framework
governance
roles

Question 6

A large, complex organisation may have m________ risk management policies.

Answer 6

multiple

Question 7

Dedicated risk management procedures may be used by organisations to control certain types of risk, such as building evaciations, systems r________ or suspicious f____________ transactions.

Answer 7

recovery

financial

Question 8

Organisations may use technology systems to support their risk assessment. These are known as r____ m__________ i__________ s_______ (RMIS).

Answer 8

risk management information systems

Question 9

Many organisations use r____ r______ to provide feedback on risk exposure. Reporting may be real time, or monthly, quarterly, etc.

Answer 9

risk reports

Question 10

What is the name of the statement that outlines the types and levels of risk that an organisation is willing to take in pursuit of its objectives, and the risk is will not tolerate in certain circumstances.

Answer 10

Risk appetite statement

Question 11

Why are training courses an important element of risk management?

Answer 11

These help explain the importance of risk management for risk management, and the associated benefits. Courses also reinforce the content of policies and procedures.

Question 12

Risk governance and compliance arrangements exist to ensure compliance with p_______ and p______, as well as laws and regulations imposed by e________ agencies or customers wo have specific requirements (e.g. meeting a certain standard).

Answer 12

policies
procedures
external

Question 13

Larger organisations will often recruit s__________ staff to support the operation and improvement of risk management.

Answer 13

specialist

Question 14

Give three examples of a specialist staff member who may support risk management.

Answer 14

Health and safety officer
Information security officer
Data protection officer
Business continuity manager
General risk manager
Conduct risk manager
Auditors
Governance professionals

Question 15

The purpose of which committee is to oversee and coordinate the design and operation of an organisation’s risk management framework?

Answer 15

The risk committee.

Question 16

The remit of the risk committee may include:

• ensuring risks are managed in a consistent, o________-supporting way
• m___________ significant risks
• balancing s__________ interests
• ensuring adequate r___________ are devoted to risk management

Answer 16

objective
monitoring
stakeholder
resources

Question 17

Merged a______ and r____ committees require careful management. There is a potential c_______ between the risk-averse role of the audit committee and the potentially risk-seeking role of the risk committee.

Answer 17

audit
risk
conflict

Question 18

Why is there a potential conflict in joint audit and risk committees.

Answer 18

The audit committee is typically risk averse, seeking accurate and financial reporting. Meanwhile the risk committee will consider taking risks proactively to support the achievement of objectives.