Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Stuff > 8. The Risk Management Process > Flashcards

8. The Risk Management Process Flashcards

1
Q

Objective setting should be an integrated process linking what to what?

A

Top level corporate planning

To business activities and operations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

As objectives are cascaded down the organisation, they become more —

A

Specific

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Objectives should be SMART, which means…

A 
Specific
Measurable
Achievable
Realistic
Time bounded
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Once objectives have been agreed, they should be — for clarification and referral

A

Documented

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Define risk IDENTIFICATION

A

The process of determining what events might occur
To affect the objectives of the organisation
And their root causes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Define risk ANALYSIS

A

The systematic use of available information
To determine the likelihood of specified events occurring
And the magnitude of their consequences

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Define risk EVALUATION

A 
The process used to determine risk management priorities
By comparing the level of risk against
Predetermined standards
Target risk levels
Or other criteria
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Risk ASSESSMENT is composed of which three sub-processes?

A

Risk identification
Risk analysis
Risk evaluation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Risk identification needs to be set in the context of what three things?

A

The organisation’s
Environment
Strategy
Attitude to risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

The organisation’s environment includes what six contexts?

A 
Political
Economic
Socio-cultural
Technological
Legislative
Ethical
(PESTLE)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Strategy is how the organisation plans to…

A

Achieve its objectives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Ideally the risk management process should be — in the organisation

A

Embedded

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the aim of risk identification?

A

To generate a comprehensive list of events
That might affect each business objective
Including the possible causes and scenarios
So that risks are well understood
And their management can be planned and implemented

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Risk management needs to be practise at — — within an organisation

A

All levels

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Why does risk management need to be practised at all levels of the organisation?

A

Because different kinds of risk, different impacts and probabilities are apparent to people at different levels and locations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are the four high-level methods for identifying risks?

A

Checklists
Benchmarking
Vulnerability assessment
Scenario planning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

An off-the-shelf checklist of sources of risk should include both — and — factors

A

Internal and external factors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

When identifying risk, some organisations use a checklist of areas of impact, such as…

A 
Increased cost
Loss of revenue
Assets
Personnel
Reputation
Quality
Capacity
Capability to deliver
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

In risk identification, what are the limitations of checklists?

A

Difficult to adapt to organisation’s circumstances

May not prompt identification of NEW risks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

In risk identification, BENCHMARKING provides useful — — on other organisation’s risk activities

A

Comparative information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

In risk identification, vulnerability assessment entails what?

A
  1. Analysing processes supporting overall business objectives
  2. Flagging up where failure or opportunities may occur
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

In risk identification, how does SCENARIO PLANNING basically work?

A

Analysts review PESTLE trends
And devise scenarios
Assigning a probability of occurrence to each

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Each of the four main methods of risk identification may be used in a range of exercises. These exercises may include…

A

Questionnaires
Brainstorming sessions
CRSA workshops

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

In risk identification, names some advantages of using risk questionnaires

A

Standardised risk model can be circulated

Cheap and easy to employ

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

In risk identification, name some drawbacks to the use of risk questionnaires

A

Depends on level of understanding of respondents
Tend to ask closed questions
Often drawn up by head of IA and may not have management support

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

In risk identification, name some advantages of using brainstorming sessions

A

Creative - may lead to identification of new risks

Uses knowledge and experience of management and staff

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

In risk identification, name some disadvantages of brainstorming sessions

A

Unless used as part of broader programme with other techniques, does not lend itself to risk evaluation, analysis, assessment or risk response selection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Where time and management preferences allow, what is the most favoured technique of risk identification?

A

The risk identification workshop

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What elements of the risk management process can the risk identification workshop be used to identify?

A 
All of them:
Risks
Existing risk management actions
Processes for embedded monitoring
Additional assurance available to management
Evaluation of risks and responses
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

USUALLY, participants in a risk identification workshop are restricted to…

A

Top management of a business unit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

The value of a risk identification workshop lies as much in participants — — the process as the documentation generated

A

Working through

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Risk identification workshops have the potential to build — — throughout the organisation and provide a sense of — over risks

A

Risk awareness

Ownership

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Name some drawbacks of risk identification workshops

A

Can be expensive and tie up people for long sessions
Quality of output dependent on level of understanding and commitment
Sometimes impossible to get entire management team together in the required time frame

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

In risk identification, CRSA is the assessment of risk and controls by —, not just management

A

Staff

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

In risk identification, what may CRSA entail?

A

Anything between a control self-certification signed off by management
Through questionnaires
To a full blown programme of enterprise-wide facilitated risk identification, analysis, evaluation and assessment workshops

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

In its most simplistic form, what are the three stages of CRSA?

A

Identify objectives for area and risks
Evaluate responses in place or required
Implement and monitor effectiveness of responses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

The right — is critically important for CRSA workshops

A

Facilitator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

An essential pre-requisite for understanding the likely success of a CRSA programme is an understanding of the organisation’s —

A

Culture

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

When using CRSA to identify risks, it is essential to obtain proper and full — from the top, to ensure it is taken seriously and acted upon

A

Sponsorship

40
Q

Advance — and — are essential for CRSA, to ensure participants understand purpose and process

A

Planning and preparation

41
Q

When planning a CRSA, it is important to select experienced and skilled — —

A

Workshop facilitators

42
Q

The right — of participants in CRSA ensures contributions are obtained for those who manage, perform and interact with the activities being reviewed

A

Mix

43
Q

CRSAs should be organised around agreed — — to prevent dominance by one individual or group

A

Ground rules

44
Q

In the course of a CRSA, it is advisable to use a — — control framework against which to assess the effectiveness of the risk management activities in place

A

Good practice

45
Q

In the course of a CRSA, it is vital not to miss — — and — — risk responses

A

Cross-functional

Inter-departmental

46
Q

The results of a CRSA must be r— to enable appropriate follow-up and ensure agreed actions are pursued to completion

A

Recording

47
Q

List the potential benefits of CRSA

A

Articulates organisation’s attitude to risk and control
Raises awareness of RM at all levels
Transfers ownership of risk to management and staff
Considers risks and controls in a constructive way
Improves motivation and performance
Provides assurance to senior management on effectiveness of existing controls against risks
Improves level of assurance given to external stakeholders

48
Q

— — risk management involves the board identifying key risks and then circulating to management for review

A

Top-down

49
Q

— — risk management involves front line management identifying the key risks and passing them up the line to top management for review

A

Bottom-up

50
Q

What are the main advantages of top-down risk identification?

A 
Strategic focus
Good buy-in at most senior level
Consistency across business units
Manageable number of risks
Speed
51
Q

What are the main disadvantages of a top-down approach to risk identification?

A

Lack of realism
Lack of buy-in at lower levels
Lack of management responsibility for risks or responses
Root causes of risk may elude top management
Superficiality

52
Q

What are the main advantages of a bottom-up approach to risk identification?

A

Buy-in at all levels of the organisation
Establishment of management responsibility for risks and responses
Avoids “one-size-fits-all” attitude
Assists in discovering root causes of risk
Wide involvement is seen as best practice in risk identification

53
Q

What are the main disadvantages of a bottom-up approach to risk management?

A 
Huge volume of detail
May be too blinkered by detail
Lack of strategic focus
Effort required to collect and analyse data
Cost, resources and time commitment
54
Q

In risk analysis, — is the chances or odds of a specific event occurring

A

Likelihood

55
Q

Likelihood may be expressed in both q— and q— terms

A

Qualitative and quantitative

56
Q

The two types of quantitative expression of likelihood are…

A

Probability

Frequency of occurrence

57
Q

What is the advantage of using probability to express the likelihood of a risk occurring?

A

Simpler to understand

58
Q

What is the disadvantage of using probability to express the likelihood of a risk occurring?

A

No reference point in time or in severity of impact

59
Q

What is the advantage of using frequency of occurrence to express likelihood?

A

Takes account of impact and expresses likelihood with reference to time

60
Q

What is the disadvantage of using frequency of occurrence to express likelihood of a risk occurring?

A

More complex and may be confusing to senior management

61
Q

In risk analysis, — is the outcome of an event expressed qualitatively or quantitatively, being a loss, injury, disadvantage or gain

A

Impact

62
Q

What are the three broad approaches to risk analysis?

A

Quantitative
Qualitative
Hybrid

63
Q

The quantitative approach to risk analysis expresses risks — relative to each other

A

Numerically

64
Q

Describe the steps in a quantitative approach to risk analysis

A

Financial value of impact estimated
Assessment made on a number of probability factors to which weightings are assigned
Financial value multiplied by various probability factors
Single rating calculated for each risk
Risks ranked by ratings

65
Q

What are the main advantages of the quantitative approach to risk analysis?

A

Appeals to quantitative style of management
Clearly ranks risks so that management attention can be focused on key priorities
If only two factors used, risks can be plotted on a graph

66
Q

What are the disadvantages of a quantitative approach to risk analysis?

A

Complex and time-consuming when multiple risk factors are analysed
If results contrary to common sense they may be ignored - assessor may fudge results
If ratings include adequacy of controls as probability factor they do not make explicit perceived effectiveness of RM activities

67
Q

— methods of risk analysis judgmentally rate risks relative to each other with descriptive adjectives such as high, medium or low

A

Qualitative

68
Q

Generally, qualitative risk analyses consider only two risk factors, — and —

A

Impact and likelihood

69
Q

How may impact be rated when using a qualitative method of risk analysis?

A

High, medium or low
Within broad financial bands
According to non-financial impacts (e.g., minor injury, serious injury, single fatality, etc)

70
Q

What are the advantages of qualitative risk analyses?

A

Rapid and simple to use
Provide general prioritisation to help direct management
Accord more with common sense

71
Q

What are the disadvantages of a qualitative approach to risk analysis?

A

Can be turn-off to quantitative style of management

Where many HH risks are identified, further prioritisation may be needed

72
Q

Whether for quantitative or qualitative approaches to risk analysis, list some sources of information that may be used to help establish likelihood and impact

A 
Historical records
Relevant experience
Industry practice and experience
Relevant published literature
Market research
Experiments and prototypes
Economic, engineering or other models
Specialist and expert judgments
73
Q

When trying to establish likelihood/impact, list some techniques that could be used to gather data

A

Interviews with relevant experts
Use of multidisciplinary groups of experts
Individual evaluations using questionnaires
Computer and other modelling techniques
Fault trees and event trees

74
Q

When evaluating risk, it is important to distinguish between the evaluation of i— risk and r— risk

A

Inherent and residual

75
Q

What constitutes the difference between inherent and residual risk?

A

The measure of the effectiveness of the risk management responses

76
Q

What factors may affect risk appetite?

A 
Organisation size
Organisation environment
Organisational culture and ethos
Organisation's products and services
Stakeholder desires
Competitors activities
Knowledge and experience of staff
Legislation and regulation
77
Q

In non-financial businesses, a q— concept of risk appetite based on subjective preferences may be more helpful

A

Qualitative

78
Q

With reference to risk appetite, what are the six postulates of RISK COMPENSATION THEORY?

A

Everyone has propensity to take risks
Propensity varies from individual to individual
Propensity influenced by potential rewards of risk taking
Perceptions of risk influenced by experience of accident losses
Individual risk taking decisions balance risk perception against propensity to take risk
Greater risk taken, on average the greater reward or loss

79
Q

Who should dictate the overall risk appetite within an organisation?

A

The board of directors

80
Q

Why should an organisation identify its risk appetite?

A

So that decisions about responses are weighed against agreed criteria

81
Q

If the board’s perspective on risk is to prevail over the perspectives of local management, what should be in place?

A

Clear risk policies

82
Q

List five downsides to a risk averse approach

A

Failure to treat risks
Leaving critical decisions to other parties
Deferring decisions which organisation cannot avoid
Selecting option because it represents a potential lower risk regardless of benefits
Avoiding or ignoring risk regardless of information available or cost of treating risk

83
Q

What are the main types of risk response?

A 
Terminate
Tolerate
Transfer
Treat
(Exploit)
84
Q

What are the two main internationally known control frameworks?

A 
COSO framework
CoCo framework (Criteria of Control of the Canadian Institute of Chartered Accountants)
85
Q

What is COSO’s definition of internal control?

A

A process
Effected by an entity’s board of directors, management, and other personnel,
Designed to provide reasonable assurance
Regarding the achievement of objectives in the following categories:
Effectiveness and efficiency of operations
Reliability of financial reporting
Compliance with laws and regulations
Safeguarding of resources

86
Q

What are the five components of the COSO integrated framework?

A 
Control Environment
Risk assessment
Control activities
Information and communication
Monitoring activities
87
Q

What are the four fundamental concepts of internal control implied in COSO’s definition?

A 
Internal control:
An integrated process
Effected by people (so imprecise)
Provides only reasonable assurance
Geared to achievement of objectives
88
Q

What are the four categories of control by TYPE?

A

Directive
Preventive
Detective
Corrective

89
Q

Give some examples of DIRECTIVE controls

A 
Plans and objectives
Policy statements
Processes, procedures and guidance manuals
Signage or traffic lights
Training programmes and CPD
90
Q

Give some examples of PREVENTIVE controls

A 
Physical or logical access controls
Segregation of duties
Protective clothing
Vetting of job applicants
Security guards
91
Q

Give some examples of DETECTIVE controls

A 
Fire or smoke detectors
Account reconciliations
CCTV cameras
Supervisory checks
Asset or stock checks
External audit
92
Q

Give some examples of CORRECTIVE controls

A 
Insurance policies
Business continuity plans
Recovery of overpayments
Refresher training
Conduct and disciplinary activity
93
Q

What are the eight categories of control by FORM?

A 
SOAPMAPS
Supervisory
Organisational
Authorisation
Personnel
Management
Accounting
Physical
Segregation of Duties
94
Q

What four key attributes of an accounting system should ACCOUNTING controls address?

A 
CAVA
Completeness
Accuracy
Validity
Authorisation
95
Q

What is the starting point for the risk management process?

A

Business objectives

Stuff (12 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions