Chapter 4 - Risk-management frameworks and standards

Question 1

At a minimum, a risk management process for an organisation will include mechanisms for what four things?

Answer 1

1. The identification of risks that could impact the organisation
2. Assessing the significance of identified risks, in order to prioritise management attention and financial resources
3. Monitoring to help detect any changes in the organisation’s exposure to identified risks
4. Controlling the organisation’s exposure to the risks that have been identified

Question 2

What are the three core elements discussed in the ISO 31000:2018? SAP

Answer 2

1. Risk-management architecture (committees, reporting structures and so on)
2. Risk-management strategy (risk policies and risk appetite)
3. Risk-management protocols (processes and procedures)

Question 3

What does a risk-management policy usually outline?

Answer 3

1. Its aims and objectives for risk-management, including how they support the wider strategic objectives
2. The processes, procedures and activities that comprise its risk-management framework, including any other risk or control policies (e.g. health and safety, information security, etc)
3. Governance arrangements for risk-management, such as the use of a risk committee
4. The allocation of roles and responsibilities for risk-management

Question 4

How can technology be used to support risk-management?

Answer 4

Organisations may use internet or internal network-based technology systems to support their risk assessment, monitoring and control activities. These are known as risk-management information systems (RMIS). These can be expensive but can help improve an organisation’s ability to co-ordinate its risk-management activities

Question 5

What is the purpose of risk reports?

Answer 5

will help management understand the organisation’s risk exposures and make effective-risk management decisions. Different reports may be produced for different areas and levels of management. The frequency of reporting will depend on how quickly risk exposures are changing or the materiality of the principal risks

Question 6

What is a risk appetite statement?

Answer 6

The types and levels of risk that an organisation is willing to take in the pursuit of its objectives, as well as the risks that it is not willing to take or will only tolerate in specific circumstances. Stakeholder risk preferences should be taken into account.

Question 7

What is the ISO 31000:2018?

Answer 7

provides a universal benchmark for risk-management practice – set of internationally recognised principles and guidance on the practice of risk-management in organisations

Question 8

What are the three main topic areas of the ISO 31000:2018? PCP

Answer 8

1. Principles for risk-management
2. Core elements of an effective risk-management framework
3. The risk-management process

Question 9

In terms of the risk-management process, ISO 31000:2018 discusses which three core elements? CAT

Answer 9

**Establishing the context
**This relates to understanding the internal and external drivers that may affect an organisation’s exposure to risk, such as the physical environment, technology, organisational structures and processes. Context also means understanding the types of risk that may affect an organisation and the various assessment and control tools that are available to use.

**Risk assessment
**Risk assessment means that an organisation should identify, analyse and evaluate its exposure to all sources of risk to its objectives. Risk assessment may involve the use of statistical models or qualitative judgement.

**Risk treatment (risk control)
**Risk treatment is another term for risk control. The aim is to ensure that the level of exposure is controlled: not too high or too low. The level of control will be influenced by the risk appetite of an organisation.

Question 10

According to ISO 31000:2018, what are the three core activties of the RM process? CRM

Answer 10

**Communication and consultation
*** Communicating risk-management information (such as policies, procedures or exposures) in a timely, accurate and factual way
* Consulting with key stakeholders
* Communication seeks to promote awareness and understanding of risk and how to deal with it, whereas consultation involves obtaining feedback and information to support decision-making.

**Recording and reporting
**Recording means ensuring that identified risks are documented properly. It also means documenting risk-management processes and procedures to ensure that they are understood and implemented across the organisation.
Reporting means reporting on an organisation’s risk exposures and the measures taken to control these exposures to the relevant decision-makers and stakeholders

Monitoring and review – about learning, improving and adapting
This might include activities such as audits, control effectiveness reviews and compliance reviews. ISO 31000 makes it clear that organisations should review and upgrade their RM activities on a regular basis.
As an organisation changes its strategic objectives or operational activities, it must ensure that its RM framework and associated policies, processes, procedures and controls remain fit for purpose

Question 11

What is the COSO ERM framework? GRIPS

Answer 11

The COSO ERM Framework is intended for organisations to integrate risk-management into its strategy, operations and decision making. The framework is presented as a set of principles organised into five inter-related components:

1. Governance and culture – stakeholders behave in a manner consistent with organisations’ values and code of conduct. Organisation to undertake activities that support the strategic, operation and RM objectives
2. Strategy and objective setting – in line with the company’s risk appetite
3. Performance – identifying and assessing risks that may affect the achievement of an organisations’ objectives
4. Review and revision – based on outcome of previous activities, evaluation of continued appropriateness of RM
5. Information, communication and reporting

Question 12

What is COBIT?

Answer 12

The guideline Control Objectives for Information and Related Technologies (COBIT), published by the Information Systems Audit and Control Association (ISACA), provides a good-practice framework for the control of IT-related risks.

Question 13

What is British Standard 31100:2009? SOAP

Answer 13

• Reporting to Stakeholders
• Operational RM activities to be completed by IC and governance function
• Assurance to board on RM activities
• Proactive manner not reactive

Question 14

What are the principles outlined by the Orange Book? GICIC

Answer 14

1. Governance and Leadership
2. Integration (into the organisation and its activities)
3. Collaboration and the communication of information
4. Risk-management processes (identification, treatment, monitoring and reporting)
5. Continual improvement