Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

IRM > IRM > Flashcards

IRM Flashcards

1
Q

What does a good risk register look like?

A

Collates risks & controls
Tailored to your organisation Updated regularly
Informs decision making
Enable team to prioritise & manage their risks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is risk policy?

A

Risk policy is the ‘what’, framework and guidelines to manage risks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are risk procedures?

A

Procedures is the ‘how’

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the ISO 31000, 8 key RM steps?

A

Communication & Consultation; Scope, Context & Criteria; Risk Identification; Risk Analysis; Risk Evaluation; Risk Treatment; Monitoring & Review; Recording & Reporting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are the COSO (2004), 8 Key RM steps?

A

Internal Environment; Objective Setting; Event Identification; Risk Assessment; Risk Response; Control Activities; Info, Comms, Monitoring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the 4 RM standards?

A

ISO 31000, COSO (2004), COSO (2017), The Orange Book

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are the 5 components of COSO (2017)?

A

Governance & Culture; Strategy & Objective Setting; Performance; Review & Revision; Info, Comms & Reporting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is Principle A of the Orange Book?

A

RM as an essential part of governance & leadership

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is Principle B of the Orange Book?

A

RM an integral part of all organisational activities to support decision making

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is Principle C of the Orange Book?

A

RM shall be collaborative
and informed by the best available
information and expertise

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is Principle D of the Orange Book?

A

RM to have structured processes incl, risk identification & assessment, risk treatment, risk monitoring risk reporting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is Principle E of the Orange Book?

A

RM shall be continually
improved through learning and experience

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are the 3 components of context?

A

Internal, External, Risk Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is the purpose of establishing context according to ISO 31000?

A

To enable effective risk assessment & treatment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the extended enterprise?

A

Organisation’s come together to achieve objectives they could not achieve on their own

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are the key elements of the extended enterprise?

A

Core activities, key inputs & outputs, external influences

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What does PESTLE help to do?

A

Anlysis an organisation’s context

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is Mendelow’s matrix?

A

Helps with stakeholder mapping

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are some difficulties in setting objectives?

A

Picking ones that support the mission; conflicting stakeholder expectations; context constantly changing;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is the attachment of risk?

A

The process of transferring or assigning a specific risk or liability from one party to another

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What are the 3 stages of risk assessment?

A

Risk identification, risk analysis, risk evaluation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is the purpose of risk identification?

A

To find, recognise and describe risks that might prevent/help org from achieving its objectives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is a cause? risk? consequence?

A

Thing happening now or has happened. The uncertainty. Impact on objectives.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What are Hopkins 5 techniques for risk assessment?

A

Checklists & questionnaires; workshops & brainstorming; inspections & audits; flowcharts & dependency analysis; crowd sourcing technology

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Words to describe emerging risks?

A

Ambiguous, chaotic, complete, uncertain, volatile

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is the definition of an emerging risk?

A

A risk that is new or a familiar risk in new/unfamiliar context/under new context conditions. Potentially signification but not fully understood, cannot allow RM with confidence.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is the importance of risk classification?

A

Structure to risk identification process; facilitate identification of more risks; consistent risk terminologies; assign responsibilities; estimate total exposure; bundle risk treatment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What does FIRM help with and stand for?

A

Risk classification. Financial, Industrial, Reputational, Marketplace

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What are the 5/4 Ts for risk control?

A

Terminate, Treat, Transfer, Tolerate, Take

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Sartarla designed a flow chart to …?

A

Decide what is a real control? To challenge effectiveness.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

How does the ISO 31000 define a control?

A

A measure that maintains/modifies a risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What are the 5 response strategy types (5 E’s)?

A

Explore opportunities; opportunities Exploited further; opportunities in decline must Exit; Expand;Exist in maturing or decling markets.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What is damage limitation?

A

Reducing the magnitude/severity of risk when it occurs, manage impacts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What is loss prevention?

A

Reducing likelihood of risk and also impact if it does

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What is a preventative control?

A

Before risk occurs, internal control used to avoid undesirable event occuring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What is cost containment?

A

When a hazard risk materializes despite the efforts put into loss prevention and damage limitation, there may well still be a need to contain the cost of the event

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What is the most effective/best type of control?

A

Preventative control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What is a directive control?

A

Directions for how to behave eg. contracts, pre-event

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What are detective controls?

A

Detect a risk eg. fire alarm, post event

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What are anticipatory controls?

A

Long-term & strategic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What are corrective controls?

A

Implemented once risk has occured

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What controls are implemented pre-event?

A

Preventative, Directive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What controls are implemented post-event?

A

Corrective, Detective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What type of control is insurance?

A

Corrective, post-event

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What type of control is business continuity?

A

Corrective, post-event

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Is business continuity a loss prevention, damage limitation or cost containment?

A

Cost containment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What is an engineering control?

A

Isolate people from the hazard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

What is an administrative control?

A

Change the way people work

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

What is an elimination control?

A

Physically remove the hazard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

What is the substitution control?

A

Replace the hazard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

What is the swiss cheese model?

A

A slice of Swiss cheese is symbolic of a given measure taken to minimize risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

What is the purpose of monitoring & reviewing according to ISO 31000?

A

To assess & improve the quality & effectiveness of process design implementation and outcomes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

What are some methods to monitor risk?

A

KRIs, KCIs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Monitoring is …. but review is … & ….?

A

Monitoring is ongoing but review is periodic & changes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

What a are 4 ways to collect data?

A

Audits, Customer audits, internet of things, satellite data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

What is big data?

A

Data that contains variety, arriving in increasing volume & more velocity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

How does ISO 31000 define risk?

A

‘effect of uncertainty on objectives’

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

What are Hopkins 4 categories of risk?

A

Hazard, Opportunity, Compliance, Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

How does ISO 31000 define RM?

A

‘coordinated activities to direct & control an organisation with regard to risk’

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

What is needed for ERM to work effectively?

A

High investment, high risk maturity, strong risk assurance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

When was RM introduced?

A

1995

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

Why is it important to know about the history or RM?

A

To know, where we are now & where we might be in the future, conventional views have to be altered

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

What is a downside risk?

A

Event whose outcomes are negative

64
Q

What does STOC stand for?

A

Strategy, Tactics, Operations, Compliance

65
Q

What is risk exposure?

A

Likelihood of risk materialising and impact when it does

66
Q

What is risk attitude?

A

Organisation’s approach to assess & pursue, retain, take or turn away risk

67
Q

What is risk appetite?

A

Amount & type of risk an organisation is willing to pursue or retain

68
Q

What does FIRM stand for?

A

Financial, Industrial, Reputation, Marketplace

69
Q

What are the 4Ts of Hazard RM?

A

Tolerate, Treat, Transfer, Terminate

70
Q

What is the Sartarla approach to ERM?

A

Define context & objectives; assess the risks; manage the risks; review & report

71
Q

What is a climate physical risk?

A

Impact from actual climate change

72
Q

What is climate transitional risk?

A

Changes as activities to move to a more sustainable approach

73
Q

What is a climate legal risk?

A

Knowingly continuing to contribute to climate warming

74
Q

What is the law that mandates certain practices in finance recording keeping & reporting called?

A

Sarbanes-Oxley law

75
Q

Name a banking regulator

A

International Basel Accordance

76
Q

Name an insurance regulation

A

European Union Solvency

77
Q

What is an operational risk?

A

Risk a company faces in the course of conducting its daily business activities, procedures, and systems

78
Q

What does PRAM stand for?

A

Project Risk Analysis Management Guide

79
Q

Definition of a project?

A

Unique, transient endevours undertaken to achieve objectives

80
Q

When was H&S legislation enacted?

A

1800s

81
Q

What does COSHH stand for?

A

The Control Of Substances Hazardous to Health

82
Q

What does RIDDOR stand for?

A

The Reporting of Injuries, Diseases and Dangerous Occurrences Regulations

83
Q

When and where was the first RM standard?

A

1995, New Zealand

84
Q

What does the ISO 31000 include?

A

What good RM looks like - the Principles; what is needed to implement effective RM - the Framework; steps in RM - the Process

85
Q

What does RASP stand for?

A

Risk Architecture, Strategy & Protocols

86
Q

What is included in the COSO ERM Cube?

A

Includes RM PROCESS, ORGANISATIONAL activities & IMPLEMENTATION process of the standard

87
Q

What is the H&S standard?

A

ISO 45000

88
Q

What is the Legal standard?

A

ISO 31022

89
Q

What is the projects standard?

A

PRAM

90
Q

According to ISO 31000, what is the purpose of RM?

A

The creation & protection of value

91
Q

What does PACED stand for?

A

Proportionate, Aligned, Comprehensive, Embed, Dynamic

92
Q

What do the elements of PACED mean?

A

Proportionate- customised to suit org
Aligned - integrated with org activities
Comprehensive - consistency of RM process
Embed - change risk attitude, behaviour, culture
Dynamic - process does not finish with risk register, inc decision making & value

93
Q

What is Agency Theory?

A

The concept used to explain relationship between principles (someone who relies heavily) & their relative agent

94
Q

What is Risk Architecture?

A

Committe structure & terms of reference; roles & responsibilities; internal reporting requirements

95
Q

How does Hopkins advise you implement ERM?

A

PIML - Planning, Implementing, Measuring, Learning

96
Q

What does PIML stand for and represent?

A

Planning, Implementing, Measuring, Learning. How Hopkins advises you implement ERM.

97
Q

What must you consider in time it takes to implement ERM?

A

Start position, commitment from TOP, size & complexity, resources available, org as global actor

98
Q

What does risk status show?

A

Risk lifecycle

99
Q

What are the 8 risk status’?

A

Draft, Activity, Ongoing, Rejected, Escalated, Deleted, Expired, Closed/Managed, Closed/Occured

100
Q

What does ‘draft’ risk status mean?

A

Risk only just raised, needs to be assessed to ensure real risk

101
Q

What does ‘activity’ risk status mean?

A

Actively dealing with risk, further actions required to manage.

102
Q

What does ‘ongoing’ risk status mean?

A

Managed risk to acceptable level, not closed & may change. KRIs developed.

103
Q

What does ‘rejected’ risk status mean?

A

Problems & issues, not risks

104
Q

What does ‘escalated’ risk status mean?

A

Do not effect objectives of activity but effect other areas of business

105
Q

What does ‘deleted’ risk status mean?

A

No longer occurring due to external changes

106
Q

What does ‘expired’ risk status mean?

A

Passed in time and can no longer occur

107
Q

What does ‘closed/managed’ risk status mean?

A

Successfully managed

108
Q

What does ‘closed/occured’ risk status mean?

A

Has occured

109
Q

What is a consultation?

A

A process which impacts on a decision through influence rather than power. Input into decision making, not joint decision.

110
Q

What is some useful input shared in risk reports?

A

Level of confidence that objectives can be met; important changes - risks, controls, context objectives; emerging risks; new risks; themes/trends; actions

111
Q

What are 4 types of risk reporting according to The Orange Book?

A

The principal risk report; deep dive report; risk radar; risk moderation

112
Q

How many decision making steps does Druker have?

A

6

113
Q

Culture definition?

A

Ideas, customs, beliefs, behaviours, showed by groups of people

114
Q

Risk culture definition?

A

How people perceived, understand & manage risks

115
Q

How to take a positive stance on risk culture?

A

Good comms of org’s expectations of all staff; convincing employees they will benefit; involvement in risk identification process; training programs

116
Q

How does Hillson define risk attitude?

A

Chosen responses to uncertain situations, driven by whether uncertainty is perceived as favourable/neutral/hostile.

117
Q

What is anchoring bias?

A

Influenced by info we already know

118
Q

What are 5 types of bias?

A

Confirmation, conformity, authority, bandwagon, anchoring

119
Q

What 3 factors influence risk perception?

A

Conscious, subconscious, affective

120
Q

What does LILAC stand for and show?

A

Risk Culture Model. Leadership, Involvement, Learning, Accountability, Communication

121
Q

What is the ABC model?

A

Risk culture model. risk Attitude, risk Behaviour, risk Culture.

122
Q

What are 5 indicators of a positive safety culture?

A

Leadership - promoting positive safety culture; Involement of staff; Existence of learning culture; Existence of just culture

123
Q

Can you have a ‘risk-aware’ culture?

A

No, these are attitudes, so you can a have a ‘risk-aware ATTITUDE’

124
Q

Is ‘the way we do things around here’ risk behaviour or risk attitude?

A

Risk behaviour

125
Q

Hopkins definition of risk attitude?

A

The long term view of the organisation to risk determined by 4 C’s - comfort, cautious, concerned, critical

126
Q

What is Hopkins 4 C’s related to risk attitude?

A

Comfort, cautious, concerned, critical

127
Q

What is the Double S Model?

A

Culture having 2 dimensions.
Sociability - people focus
Solidarity - task focus

128
Q

What are some benefits of Sociability in the Double S Model?

A

Encourages cohesive & common purpose. People go beyond what is expected

129
Q

What is a negative of Sociability in the Double S Model?

A

Friendships may lead to poor performance

130
Q

What are some benefits of Solidarity in the Double S Model?

A

Risk controls & actions implemented. Relationships formed on mutual interest. Swiftly mobilise a team.

131
Q

What is a negative of Solidarity in the Double S Model?

A

They may ask ‘what’s in it for me’?

132
Q

How can you measure risk culture?

A

Surveys

133
Q

What are the elements of the risk culture aspects model?

A

Tone from the top; Governance; Competency; Decisions

134
Q

How to change risk culture according to IRM?

A

Plan & implement cultural change
Monitor & adapt to change
Evaluate current risk culture
Assess impact of current risk culture
Identify areas of improvement

135
Q

What are Hopkins risk appetite principles?

A

Acknowledging interconnectness; Measurability; Variability

136
Q

Define risk capacity

A

A measure of how much risk should/can take

137
Q

Define risk tolerance

A

The boundaries outside of which organisation will not venture

138
Q

What are the benefits of adopting a risk appetite?

A

Reducing uncertainty; Improve consistency; Focus on priority areas; Improve resource prioritisation

139
Q

How does the IRM define risk appetite?

A

Amount of risk org is willing to seek/accept in pursuit of long term objectives

140
Q

What is the optimal risk position?

A

Level of risk the organisation aims to operate

141
Q

What is the tolerable risk position?

A

Level of risk the organisation is willing to operate

142
Q

Who is responsible for the determining the nature & extent of risks willing to take?

A

The Board

143
Q

What are Hopkins’ stages in developing risk appetite statements?

A

Identify stakeholders & expectations
Define org wide risk exposure
Establish desired risk exposure
Define acceptable volatility
Formulate statement & communicate

144
Q

What are the 5 levels of risk appetite?

A

Opposed/adverse
Minimalist
Cautious
Mindful/open
Enterprise/eager

145
Q

What are IRMs key principles when designing risk appetite?

A

RA can be complex; needs to be measurable; not single, fixed concept; develop in line with org capability & maturity; strategic, tactical & operational level;

146
Q

What is maturity?

A

Context, culture, systems, processes

147
Q

What is capability?

A

Financial, reputational, people, infrastructure

148
Q

What does TARP stand for and what is it?

A

H&S Triggers. Triggered Action Response Plans

149
Q

What questions does the IRM ask to test RA statement?

A

Does it provide guidance for decision making? Do execs understand aggregated/interlinked level of risk to determine what is acceptable? Understand RA not constant? Decision make consideration of reward?

150
Q

What are Deloitte’s indicators that RA statements good?

A

People taking risks knowing what objectives they are supporting; principal risks are understood; RA language permeates org

151
Q

What are the 4 levels of risk appetite?

A

High level; directional; specific; detailed

152
Q

What are Hazard risks?

A

risks that can only inhibit achievement of corporate mission

153
Q

What are opportunity risks?

A

the risks that are deliberately sought or embraced by the organisation

154
Q

What are Control risks?

A

associated with uncertainty and cause doubt about the ability to achieve the organisations mission.

155
Q

What are compliance risks?

A

the threat to an organization’s finances, organization, and reputation due to violations of rules, regulations, and laws governing its activity

IRM (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions