Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

IRM - International Certificate In ERM > Module 1 - Unit 2 (Risk Management Standards) > Flashcards

Module 1 - Unit 2 (Risk Management Standards) Flashcards

1
Q

What is a risk management standard?

A

Risk management standard = Risk management framework + risk management process

  • It’s a published guide for managing risk.
  • It sets out the overall approach to the successful management of risk.
  • Including a description of the risk management process, together with the suggested framework that supports the process (Hopkin)

Examples include ISO 31000, COSO ERM cube, and COSO Internal Control Framework

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What was the first ever risk management standard called, and in what year was it released?

A
  • AS/NZS4360

* 1995

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Define ‘risk management process’.

A

The risk management process is the stages in the process of managing risks, which is driven mainly by how you set up the framework (but also affected by the internal and external environment).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

If an organisation decides to follow the structure of the IRM (2002) Risk Management Standard, list the 5 components of risk management it would have to include in its framework.

A
  • Structure
  • Responsibilities
  • Administration
  • Reporting
  • Communication
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

State the first stage in the risk management process according to ISO 31000.

A

“Establish the scope, context, and criteria”.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Draw the risk management process for ISO31000.

A

See Figure 6.4 ‘RM process for ISO 31000 (2018)’ Hopkin (2018).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

As part of the ISO 31000 risk management process, ‘monitoring and review’ is best thought of as which of the following:

A. An extra stage
B. A feedback loop
C. Part of an iterative process

A

C - because each of the stages in the process may be executed multiple times before the risk evaluation is finalised and the appropriate risk treatment agreed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

State the 5 components of the ISO 31000 risk management framework.

A
  • The role of ‘leadership and commitment’ is noted in this section
  • The framework is presented as a continuous improvement model, similar to the PIML model.
  • The purpose = to assist with integrating risk management into all activities and functions.
The 5 components are as follows:
• Integration
• Design
• Implementation
• Evaluation
• Improvement
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

State the 8 ISO 31000 risk management principles.

A
  • The principles outlines what must be achieved, and the framework provides information on how to achieve the required integration.

Value, Creation, and Protection:

  1. CUSTOMISED
  2. INCLUSIVE
  3. STRUCTURED and COMPREHENSIVE
  4. INTEGRATED
  5. DYNAMIC
  6. Best available information
  7. Human and cultural factors
  8. Continued improvement

First 5 principles are similar to PACED

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Draw the COSO ERM Cube.

A

See Figure 6.3 ‘COSO ERM Cube’ Hopkin (2018).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

From COSO (2014), what are the four elements that make up the COSO ERM Business Model.

A
  1. Business planning
  2. Execution
  3. Adapting
  4. Monitoring
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

State, and describe the 8 components (risk management process) of the COSO ERM Cube.

A
  1. INTERNAL ENVIRONMENT
    • Encompasses the tone of the organisation and sets the basis for how risk is viewed and addressed
  2. OBJECTIVE SETTING
    • Objectives must exist before management can identify potential events affecting their achievement
  3. EVENT IDENTIFICATION
    • Internal and external events affecting the achievement of objectives must be identified, distinguishing between risks and opportunities.
  4. RISK ASSESSMENT
    • Risks are analysed, considering the likelihood and impact, as a basis for determining how they should be managed.
  5. RISK RESPONSE
    • Management selects risk responses: avoiding, accepting, reducing, or sharing risk.
  6. CONTROL ACTIVITIES
    • Policies and procedures are established and implemented to help ensure the risk responses are effectively carried out.
  7. INFORMATION AND COMMUNICATION
    • Relevant information is identified, captured and communicated so that people can fulfil their responsibilities.
    • Effective communication also occurs in a broader sense, flowing down, across, and up the entity.
  8. MONITORING
    • The entirety of ERM is monitored and modifications are made if necessary.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

State the four categories of organisational objectives of the COSO ERM Cube.

A

SORC

  • Strategic
  • Operations
  • Reporting
  • Compliance
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

State the four categories that represent the implementation process of the COSO ERM Cube standard (entities)

A
  • Entity-level
  • Division
  • Business Units
  • Subsidiary
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

COSO issued revised guidance in 2017, ‘Integrating with strategy and performance’, state the 5 components of the double helix.

A
  1. Governance & Culture
  2. Strategy & Objective Setting
  3. Performance
  4. Review & Revision
  5. Information Communication & Reporting
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Draw a diagram which shows the relationship between the risk management context, risk management process, and the organisation’s context.

A

See Figure 7.1 ‘Three components of context’ Hopkin (2018).

17
Q

Define the following terms:

(i) Risk Management Framework
(ii) Risk strategy
(iii) Risk architecture
(iv) Risk protocols

A

(i) Risk strategy, architecture, and protocols fit into the wider risk management context, also known as the risk management framework, which helps drive the risk management process
(ii) Risk strategy is set out in the risk management policy statement: strategy, appetite, attitudes, and philosophy.
(iii) Risk architecture sets out the lines of communication for reporting on risk management issues and events, and roles and responsibilities are defined.
(iv) Risk protocols are defined in the risk guidelines of the organisation, and include the rules and procedures, as well as the risk management methodologies, tools, and techniques that should be used.

18
Q

Explain what is meant by ‘risk architecture’ of an organisation, and contrast the risk architecture with the ‘risk protocols’.o

A

Risk architecture:
•Risk architecture sets out the lines of communication for reporting on risk management issues and events, and roles and responsibilities are defined.
• An illustrative example could be an organisation chart that shows the committee structures relating to risk reporting and accountabilities, or a risk committee’s terms of reference.
• It is vital that the risk architecture reinforces the fact that responsibility for managing risks remains with the owner for that risk.
• It describes who does what in relation to risk management and how the reporting structure works.

Risk protocols:
• Risk protocols are defined in the risk guidelines of the organisation, and include the rules and procedures, as well as the risk management methodologies, tools, and techniques that should be used.
• Risk management guidelines normally refer to the standards that should be achieved. These procedures will provide direction for directors, managers, and staff within the company.
• They are vital for the delivery of the businesses risk management process and ensure that risk management is undertaken in a consistent and controlled way.
• For example, the risk register forms part of the risk protocols.

Therefore, the two are completely different, yet both are part of the wider subject of the risk management framework.

19
Q

List the components of the risk architecture, strategy, and protocols (RASP) which make up the risk management framework.

A 
Risk Architecture:
• Committee structure and terms of reference
• Roles and responsibilities
• Internal reporting requirements
• External reporting controls
• RM assurance arrangements
Risk Strategy:
• RM statement/policy
• RM philosophy
• Arrangements for embedding RM
• Risk appetite and attitude to risk
• Benchmark tests for significance
• Risk assessment techniques
• Risk priorities for the present year
Risk Protocols:
• Tools and techniques
• Risk Classification System
• Risk assessment procedures
• Risk control rules and procedures
• Responding to incidents, issues and events
• Documentation and record keeping
• Training and communication
• Audit procedures and protocols
• Reporting/disclosures/certification
20
Q

Identify which category of RASP a risk management information system would best be placed.

A

Risk protocols

21
Q

In setting up the ‘risk architecture’, the board are considering whether the audit committee should report to the risk committee, or whether the risk committee should report to the audit committee.
State which of these two options is most preferable.

A

The risk management committee should report to the audit committee.

22
Q

Correct the following statement:

“The organisation’s risk priorities for the present year form part of the protocols for the risk management framework.”

A

Protocols should read ‘strategy’

23
Q

Define what is meant by a ‘risk register’.

A

A risk register is a document used for recording risk management process for identified risks.

24
Q

Explain why there is always a danger that the risk register could become a static document.

A
  1. Static risk register means the risk register becomes out of date (it becomes a photo snapshot of risks in a particular time, rather than a movie).
  2. There is an argument that the register needs to be updated and monitored continuously, so the organisation can record the latest true status of risks in the business.
25
Q

Explain the main differences between a ‘risk policy’ and a ‘risk manual’.

A
  • The risk management strategy for the organisation will be set out in the risk management policy statement (part of the risk management strategy).
  • The risk management policy includes an introduction, objectives and link to the risk management.
  • The risk management manual will set out responsibilities for risk, as well as the arrangements for implementing the policy (part of the risk management protocols).
26
Q

Describe four benefits of developing a risk register for your new business.

A
  1. It facilitates risk ownership.
  2. It provides the means of quickly presenting in a standard format the most significant risks to those people who need to know.
  3. It provides a universally agreed set of risks along with their severity.
  4. It records the actions taken (or in some cases alerts on inactions) to deal with the risk along with a range of possible further actions.
27
Q

Which of the following would you expect to see in the context of risk strategy in the risk architecture, strategy, and protocols framework (RASP):

  1. The risk and audit tram report to the board quarterly.
  2. The tolerance level of risk is clearly defined.
  3. Ownership of risk is delegated to business units.
  4. The organisation has a defined risk appetite.
A

2 & 4

28
Q

List five components of an organisation’s external context.

A 
Typically the organisation’s:
• Industry
• Products
• Markets
• Logistics
• Supply chain
• Competitors
• Countries of operation
29
Q

List five components of an organisation’s internal context.

A 
Typically the organisation’s internal workings:
• Divisions
• Departments
• Structures
• Cultures
• Leadership
• Strengths and weaknesses
30
Q

Identify one reason why the risk management framework and process should be dynamic.

A

• Define ‘dynamic’
- iterative, and the organisation keeps up to date with changes to it’s risk management, internal, and external context.

  • Because the internal and external context are constantly changing.
  • So risk management activities (RASP and the process) should be flexible and dynamic enough to change with change and thus remain relevant.
31
Q

Name three alternative Risk Management Standards

A
  • COBIT
  • CoCo Framework (1995) - Canadian Criteria of Control
  • The Orange Book (HM Treasury 2004)
  • Basel III (Banking)
  • Solvency II (Insurance)
33
Q

The Orange Book (HM Treasury, 2004) Risk Management Standard

A
  • UK Government Sector
  • Sector-specific risk management standard
  • Had generic value in its own right

The Orange Book’s risk management model and process diagram:

  1. The management of risk is not a linear process.
  2. Specific risks cannot be addressed in isolation from each other.
  3. The whole model has to function in an environment in which risk appetite has been defined.
  4. Core risk management processes blend together, and not isolated, but takes place in a context.
  5. Certain key inputs have to be given to the overall process in order to generate the outputs which will be derived from risk management.
34
Q

COBIT (Control Objectives for Information and Related Technology)

A

• Specialist standard in the IT sector
• Provides guidance on technology risk management
• Provides good practice across a domain - process framework
• Focus on control, less on execution
• Helps optimise:
- IT enabled investments
- Ensure service delivery
- Provide a measure against which to judge when things go wrong.

35
Q

Name the three different focus elements of risk management standards

A
  1. Meeting or exceeding organisation’s objectives
  2. Adhering to control-based objectives, rules and/or controls.
  3. Complying with regulatory requirements
36
Q

Define what the overall approach of Governance, Risk, and Compliance is based on.

A

The separation of functions.

IRM - International Certificate In ERM (12 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions