4.4 National standards and guides

Question 1

Which British Standard implements ISO 31000?

Answer 1

BS 31100

Question 2

When was BS31100 published?

Answer 2

2011

Question 3

BS 31100 provides advice and guidance on d_______, implementing and m___________ proportionate and effective risk management.

Answer 3

developing

maintaining

Question 4

BS 31100 includes:

• how to manage risk p_________, not reactively
• operating of effective risk management o________
• providing a_______ to the board and senior management
• reporting to s_____________

Answer 4

proactively
oversight
assurance
stakeholders

Question 5

Which Irish agency provides guidance on implementing ISO31000?

Answer 5

National Standards Agency of Ireland

Question 6

What is the purpose of the “Orange Book” published by the UK Government?

Answer 6

The Orange Book establishes the concept of risk management for government organisations and departments.

Question 7

The Orange Book asks government departments to consider the “extended enterprise”. What does this mean?

Answer 7

Extended enterprise refers to the risk management needs of stakeholders.

Question 8

What are the benefits and downsides of the Institute of Risk Management Standard compared to the ISO31000 standard.

Answer 8

The IRM standard is free to download in 14 languages, but has not been updated as recently as ISO31000.

Question 9

The IRM Standard (2002) considers risks as having both an u______ and a d________. Good risk management should help organisations exploit o______________ and mitigate t______.

Answer 9

upside
downside
opportunities
threats

Question 10

The IRM standard identifies four external risk factors, or drivers. What are these?

Answer 10

Financial risks (eg. interest rates)
Strategic risks (e.g. research)
Operational risks (e.g. regulatory change)
Hazard risks (e.g. environmental threats)

Question 11

The IRM standard identifies four internal risk factors. What are these?

Answer 11

Financial risks (e.g. volatile cash flow)
Strategic risks (e.g. competition)
Operational risks (e.g. misconduct)
Hazard risks (e.g. health and safety)

Question 12

The COSO Enterprise Risk Management Framework underwent a major revision… when?

Answer 12

2017

Question 13

The COSO ERM Framework recognises that although risk management is an important part of effective governance, this does not preclude using risk management to help improve s_________ and o___________ performance.

Answer 13

strategic

operational

Question 14

The COSO ERM framework is presented as a set of principles organised into five components:

• governance and c_______
• strategy and o_______ setting
• performance
• review and r_______
• information, communication and r________

Answer 14

culture
objective
revision
reporting

Question 15

What is COBIT 5?

Answer 15

Control Objectives for Information and Related Technologies - i.e. a framework for IT related risk.