Module 1 Unit 3 Risk Context, Obj and assessment

Question 1

What is the risk management context ? Tip: Acronym

Answer 1

The risk architecture, strategy and protocols or risk management framework within the organisation.

Question 2

What are the two functions of the the risk management context/Risk framework?

Answer 2

Provide support for the risk management process within the organisation

Ensure that the outputs from the risk management process are communicated to internal and external stakeholders

Question 3

Explain Internal Context

Answer 3

The internal context includes the internal environment where an organization or team operates to achieve its objectives.
It encompasses governance, reporting arrangements, operational structure, roles, and responsibilities.

Question 4

What elements make up the external context?

Answer 4

The social, cultural, political, legal, regulatory, financial, technological, economic, natural and competitive environment whether international, national, regional or local.

The industry, products, markets competitors, suppliers, customers, logistics and the regions and countries of operation

Key drivers and trends impacting on the objectives of the organisation

Relationships with and the perceptions and values of external stakeholders

Understanding the external environment can help answer questions such as:
* what does the world around us look like?
* What is driving our strategic direction?

Question 5

What are the elements of a risk aware culture, LILAC?

Answer 5

Leadership
Involvement
Learning
Accountability
Communication

Question 6

What are the elements of SMART.

Answer 6

Specific
Measurable
Achievable
Realistic and resourced
Time limited

Question 7

How can an organisation assess the benefits of a fully implemented and effective ERM framework? AKA What are the outputs from ERM?

Answer 7

Mandatory obligations fulfilled
Assurance obtained
Decision making enhanced
Effective and efficient core processes

MADE2

NB an organisation can also assess the benefits of a fully implemented and effective ERM framework by way of a process called FIRM.

Question 8

What are the benefits of ERM?

Answer 8

Achievement of goals under the FIRM scorecard.

Question 9

What are the COSO (2017) components?

Answer 9

Governance and culture
Strategy and objective setting
Performance
Review and revision
Information, communication, and reporting

Question 10

What factors can impact the implementation of a fully functioning ERM programme?

Answer 10

The start position - what is already in place that the enterprise can build on?

· The commitment from the “top” – the greater commitment and involvement of the “C” suite the more quickly the programme will be implemented and embedded.

· The size and complexity of the enterprise.

· The extent to which the enterprise is a global actor

· The resources available to support implementation

Question 11

Why is setting business objectives difficult and potentially a source of risk?

Answer 11

1. Balancing Objectives and Stakeholder Expectations:
   
   • Agreeing on a strategic mission is easier than choosing suitable objectives.
   • Objectives must balance conflicting stakeholder expectations, leading to compromises or conflicts.
2. Continuous Re-evaluation:
   
   • Strategies and objectives need constant questioning due to changing internal and external contexts.
   • A sensible mission today could become obsolete tomorrow.
3. Clarity and Communication:
   
   • An unclear or inappropriate mission can lead to misinterpretation and disorganisation.
   • The mission must be understood at all levels and effectively cascaded into tactical and operational objectives.
4. Acceptance of Objectives:
   
   • Objectives must be fully accepted by those responsible for delivering them.
   • Risks arise if formal objectives differ from informal objectives.
5. Setting Realistic Objectives:
   
   • Easy-to-achieve objectives reduce short-term risk but may increase long-term exposure if over-ambitious objectives are set.

Question 12

Why does COSO 2004 AND 2017 consider objective setting so important

Answer 12

CUBE 2004 which has objective setting in the second row after the internal environment.

The text states that ‘the board should set objectives that support the mission of the organization that are consistent with its RISK APPETITE.’ If the board is to set objectives effectively, it needs to be aware of the risks arising if DIFFERENT objectives are pursued.

2017 - Enterprise risk management ensures that management has in place a process to set objectives and that the chosen objectives support and align with the entity’s MISSION and are consistent with its RISK APPETITE.’ It further states that ‘There is a direct relationship between objectives, which are what an entity strives to achieve, and enterprise risk management components, which represent what is needed to achieve them’.

Question 13

How do you set strategy and objectives in standards. Note a RM standard provides FW and guidance for risk process.

ISO 31000 outlines principles and guidelines for a systematic approach to risk management, applicable to any organization, regardless of size or industry

Answer 13

Develop a Consistent Mission
Develop suitable objectives
Build Strategy in line with Risk Appetite using context of the org at that point in time (remember context will change over time, so strategy will need updating app intervals, and so should ERM approach)
Implement strategy - culture of org may read the mission differently to others
Strategy to be accepted by everyone

Question 14

What are the 3 levels of objective setting and timings

Answer 14

Organisational, divisional and team or individual level.
Strategic 1-3 years
Tactical - typically annually
Operational - 1 year or less

Question 15

Why is it important to be able to measure objectives

Answer 15

So you can see if its been achieved - measure its realisation.
Quantitively or qualitative depended on measurement

Question 16

What is clawback

Answer 16

Allows an org to recover some element of paid bonuses should outcomes change over longer term. i.e. when staff are rewarded for achieving their objs meaning they take more risk (aggressive selling tactics of banks)

Question 17

How does ERM enhance strategy selection

Answer 17

Choosing a strategy calls for structured decision-making that analyses risk and aligns resources with the MISSION AND VISION of the organization

Question 18

What is risk criteria

Answer 18

Criteria measures how much risk matter to an org in relation to its ability to achieve its objs - links to risk analysis, evaluation and appetite

Question 19

What is a KPI

Answer 19

Key Performance Indicator - critical indicators of progress toward an intended result.
KPIs provide:
Focus for Strategic and Operational improvement
Analytical basis for decision making
focus on what matters most to org
Drucker: WHAT GETS MEASURED GETS DONE

Question 20

What is the role of KPIs

Answer 20

To measure performance at Strategic, Tactical and Operational levels

Question 21

What can key indicators be used to measure

Answer 21

Can be used to measure IMPACT Categories (FIRM) used in analysis
So rather than define new metrics for RM, most of these already exist.

Question 22

How can org objectives be used to develop risk metrics

Answer 22

Org objectives are the things that matter most to the org, so developing risk metrics using IMPACT categories is important

i.e. People Objective - ensure sufficient personnel with necessary SQEP and motivation to do their jobs.

KPI is monitor and measure military inflow and outflow rate.

SR is As a result of inability to recruit enough people to meet req, and numbers leaving, TIART Org will not attract recruit, train and retain or have resilience req. to deliver RN outputs.

Mitigating activity is ‘Recruitment activity plan’, New recruitment process and a better end to end process.

Question 23

What is the scope of ISO31000 (5 things)

Answer 23

Provides guidelines in managing risks customised to any org
Follows a common approach
Covers the entire lifecycle of organisational RM
Applied at all levels and functions
Decision making

Question 24

What is the purpose of establishing the scope, context and criteria (ISO31000)

Answer 24

To customise the RM process and enable effective risk ASSESSMENT and appropriate risk TREATMENT

Question 25

What should you consider when planning your approach to define the context (ISO31000)

Answer 25

Objectives and decisions that need to be made Outcomes expected from the activities Time, Location, specific inclusions and exclusions Appropriate Risk Assessment tools and techniques Resources required and Responsibilities and records to be kept Relationships with other projects, processes and activities.

Question 26

What is Risk CRITERIA or Risk Threshold

Answer 26

Organizations should define criteria to evaluate the significance of risk and support decision-making. Risk criteria should consider uncertainties affecting outcomes and objectives, and how consequences and likelihood will be defined and measured.

Question 27

What else should you consider when planning your approach to define the CONTEXT (ISO31000)

Answer 27

Need to define Internal and External environment in which you operate in Should reflect specific environment to which the RM activities are to be applied Sets structure and foundation for which Risk Assessment will be applied and ensures the reasons for this are clear Provides backdrop against which risks can be identified and assessed

Question 28

What should you consider when defining your risk CRITERIA (ISO31000)

Answer 28

Specify the amount and type of risk you may or may TAKE, RELATIVE TO YOUR OBJECTIVES

Question 29

What other way can be described as Risk CRITERA

Answer 29

Risk Appetite - specifies a technique to determine the magnitude (using a risk matrix) of a risk, or a parameter (sets the conditions) related to risk, together with a limit beyond which risk becomes unacceptable. A common technique to determine the magnitude of a risk and identify an unacceptable level is to use a risk matrix, which typically involves assessing both the likelihood of a risk occurring and the severity of its potential impact, often assigning numerical values to each factor and multiplying them together to calculate a "risk score" that indicates the overall magnitude; a predetermined threshold (Risk Appetite) on this risk score defines the point where a risk becomes unacceptable.

Question 30

How could you determine the MAGNITUDE of a risk

Answer 30

use a risk matrix, which typically involves assessing both the likelihood of a risk occurring and the severity of its potential impact, often assigning numerical values to each factor and multiplying them together to calculate a "risk score" that indicates the overall magnitude

Question 31

What should you take into account when EVALUATING the SIGNIFICANCE of a risk

Answer 31

When evaluating risks, you compare their size to certain criteria related to your goals/objectives. This helps you decide which risks need attention based on their potential to affect your goals. However, the size of the risk isn't the only thing that matters. Other factors include sustainability, resilience, ethics, laws, how well controls work, what happens if controls fail, timing, costs, and what stakeholders think.

Question 32

What should you consider when deciding against options when evaluating your risks(ISO31000)

Answer 32

Organisations often face decisions that affect multiple goals, with both potential risks and benefits. To make these decisions, they need to meet certain criteria and balance competing objectives. It's important to identify relevant criteria and decide how to weight them or make trade-offs. Different stakeholders might have different costs and benefits, so this should be considered. Also, organizations need to decide how to handle uncertainties, which involves their attitude, appetite, and tolerance for risk.

Question 33

What is Risk Attitude (ISO31000)

Answer 33

It is your approach to assess and eventually pursue, retain, take or turn away from risk

Question 34

What is Risk Appetite (ISO31000)

Answer 34

It is the amount and type of risk that you are willing to pursue or retain to achieve your objectives and outcomes

Question 35

What is Risk Tolerance (ISO31000)

Answer 35

It is your readiness to bear the risk after risk treatments are implemented to achieve your objectives and outcomes.

Question 36

What is Balanced Score Card

Answer 36

KPIs that are tracked on a regular basis Strategic Objectives, KPI, KPI target and projects that may move you towards achievement You then do the same again for operational. So how do we achieve the DP, then CP, then individual directorate objectives with KPIs, Targets and the HOW we could do this to move towards achieving this objective. (projects)

Question 37

What is an Extended Enterprise

Answer 37

The IRM define the extended enterprise as “a structure where a number of organisations come together in a joint endeavour in order to achieve outcomes that none of them could have achieved on their own” within the timescale within which they wish to operate, with the skills available to them.

Question 38

Explain Attachment of Risk

Answer 38

Key dependencies are the key things that the organisation needs to be successful; they might be internal or external things but in short, they are what the business depends upon for its future success. Core processes are fundamental to organisational success because they are the means of delivery of strategy and continuity of operations. A core process can be defined as “the collection of activities that deliver a specific stakeholder expectation”. Stakeholders are the groups of individuals who have a stake in the business, or are affected by what the organisation does – such as investors, suppliers, customers, the wider society and government.

Question 39

What Risk analysis tool could you use to identify Attachment of Risk

Answer 39

SWOT and consider Dependencies, Core Processes and Stakeholders.

Question 40

How does 31000 describe risk identification

Answer 40

ISO 31000 states that “the purpose of risk identification is to find, recognise and describe risks that might help or prevent an organisation achieving its objectives”.

Question 41

How does the Orange book describe a CAUSE

Answer 41

A cause is an element which alone or in combination has the potential to give rise to risk

Question 42

How does the Orange book describe an event

Answer 42

An event is an occurrence or change of a set of circumstances and can be something that is expected which does not happen or something that is not expected which does happen. Events can have multiple causes and consequences and can affect multiple objectives

Question 43

How does the Orange book describe consequences

Answer 43

the consequences should the event happen – consequences are the outcome of an event affecting objectives, which can be certain or uncertain, can have positive or negative direct or indirect effects on objectives, can be expressed qualitatively or quantitatively, and can escalate through cascading and cumulative effects

Question 44

The causes and consequences of risk can also be illustrated using....

Answer 44

A bow Tie diagram Centre of bow tie is the risk (Event) left are the immediate and underlying threats or causes. To the right are the immediate and ultimate consequences.

Question 45

How does using the Bow Tie diagram help the ERM approach

Answer 45

Because it requires us to look at the causes of the risks from all aspects of the enterprise (not just at one level) and similarly to map enterprise-wide consequences ( so several contributory causes for one risk) Note that the risk bow-tie can be used for both threats and opportunities.

Question 46

Name 5 risk techniques

Answer 46

Questionnaires and checklists workshops and brainstorming inspections and audits flow charts and dependency analysis crowdsourcing technology

Question 47

Name two qualitative risk techniques that could be used at a risk assessment/evaluation workshop

Answer 47

SWOT and PESTLE

Question 48

Name two quantitative assessment/evaluation techniques

Answer 48

Hazard and operability (HAZOP) and Failure modes effects analysis (FMEA)

Question 49

Name four definitions of likelihood

Answer 49

Unlikely, Possible, Likely and Almost Certain ( four stops people choosing the middle option)

Question 50

Name four definitions of impact

Answer 50

Small, moderate, severe, catastrophic ( hospital example)

Question 51

Define an Emerging Risk

Answer 51

Those which you know little about when they are recognised. A risk that is evolving in areas and ways where the body of available knowledge is weak. Differences between emerging risks and BAU Risks: being ambiguous, chaotic, complex, time-horizon can change, uncertain, uncontrollable, and volatile.

Question 52

Explain a compliance risk

Answer 52

Adherence to the law and regulations Captures legal and financial penalties for failing to act Represents a licence to operate

Question 53

Explain a hazard risk

Answer 53

Undermines objectives in a negative way. Most commons associated with operational risks inc H&S programmes Example is theft

Question 54

What is 31000 definition of Risk Analysis

Answer 54

ISO 31000 (2018) states: ‘The purpose of risk analysis is to comprehend the nature of risk and its characteristics, including, where appropriate, the level of risk.’ They follow this up with a note to the effect that ‘…risk analysis provides an input into risk evaluation, to decisions on whether risk needs to be treated and how.’

Question 55

What's the difference between analysing and evaluating risks

Answer 55

Analysing Risks: * Involves understanding the nature, sources, and potential impacts of identified risks. * Focuses on determining the likelihood and consequences of risks. * Uses qualitative and quantitative methods to assess risk characteristics. Evaluating Risks: * Involves comparing the results of risk analysis against risk criteria to determine their significance. * Helps prioritize risks based on their potential impact and likelihood. * Aims to decide which risks need treatment and the best ways to manage them. In short, analysing risks is about understanding them, while evaluating risks is about deciding what to do about them.

Question 56

What are the ways you could determine the importance of your risks using ANALYSIS (HELP YOU UNDERSTAND THE NATURE, SOURCES AND POTENTIAL IMPACTS OF YOUR RISKS)

Answer 56

Looking at past records. Looking at personal relevant experience (and intuition). Looking at industry-relevant experience of the risk. Looking at published literature on the risk. Doing some testing or experiments (e.g., market research). Using economic or statistical models to make forecasts. Using experts in the area of that risk to make judgments. These activities help you understand the nature, sources, and potential impacts of risks.

Question 57

What are the ways you could rate the importance of your risks using EVALUATION (DECIDING WHAT TO DO ABOUT THEM)

Answer 57

Comparing the risks based on potential impact to your objectives. Comparing the potential likelihood of happening. Comparing relative velocity. Comparing relative vulnerability of different parts of the organization the risks are linked to. Comparing relative exposure of different parts of the organization the risks are linked to. Considering proximity. Assessing the level of action or control needed to manage the risks to a desired (target) state. Comparing the relative difficulty of managing those risks. Considering the relative influence of a single risk on other risks (dependency/cascade factor). These activities help you prioritize and decide which risks need treatment and how to manage them.

Question 58

What are the 3 steps to a simple value chain (Extended Enterprise)

Answer 58

Three steps to give a simple value chain for an org. 1. Core activities of team, function, department, project or org - what is it that you do 2. The key inputs to those activities - what do you need in order to do what you do 3. The key outputs from those core activities - what is it that you deliver from those core activities

Question 59

How many risk CATEGORIES does the Orange book have

Answer 59

13, Strategy, Governance, Operations, Legal, Property, Financial, Commercial, People, Technology, Information, Security, Proj/Prog and Reputational.

Question 60

What is PESTLE and when would you use it

Answer 60

Political, Economic, Social, Technological, Legal, Environmental (PESTLE) To identify INTERNAL/EXTERNAL Context

Question 61

Mendelow's Stakeholder matrix has four boxes. What are they

Answer 61

Top left - Keep Satisfied, Top right - Actively Engage and Manage, Bottom Left - Minimal Effort and Bottom Right - Keep Informed.

Question 62

Stakeholder expectations are delivered by what core processes - Tip Acronym

Answer 62

STOC

Question 63

What is Horizon scanning

Answer 63

Exploration of what the future might look like to understand uncertainties better and to analyse whether the organisation is adequately prepared for potential opportunities and threats”. It is not about trying to predict the future but rather to review options so that evidence-based decisions can be made”.

Question 64

Explain SMART

Answer 64

SPECIFIC – be specific about what you want to accomplish MEASUREABLE – define the metrics that determine if you meet the goal ACHIEVEABLE – do you have the tools/skills needed, if not what action RELEVANT – ensure the objective is aligned to the business strategy TIME-BOUND – provide a realistic target date for delivery.

Question 65

Why is Risk Criteria important

Answer 65

Risk criteria measure how much risks matter to an organization in relation to its ability to achieve objectives. This links to risk analysis, risk evaluation, and risk appetite.

Question 67

What are the components of Internal Context

Answer 67

Structure and Processes: Divisions, departments, structures, systems, processes, and accountability. Culture and Leadership: Organizational culture, leadership, strengths, and weaknesses. Internal Stakeholders: Staff, managers, and the board. Corporate Governance: Approach to governance, resources, competencies, capabilities, and conduct. Objective Setting: Factors influencing how objectives are set and achieved.

Question 68

What questions can be answered by addressing the Internal Context

Answer 68

What are our objectives? What is our capacity? What are our business processes? How do we make decisions?

Question 69

Explain External Context

Answer 69

The external context includes the external environment where an organisation operates, affecting its ability to achieve objectives

Question 70

What could IMPACT an EXTERNAL Context

Answer 70

Financial crisis COVID-19 pandemic New Government

Question 71

What are Hopkin and Thompsons three components of 'Context'

Answer 71

The organisations risk management context (relates to the Risk FW as a whole including RASP FW) the internal context the external context

Question 72

Which part of RASP does the INTERNAL context relate to

Answer 72

Architecture (governance, reporting, operational structure, R&R's)

Question 73

What does Hopkin Thompson consider as INTERNAL context

Answer 73

Structure, objectives, policies, strategies, processes, culture, and values of its people. The A in RASP

Question 74

What do Hopkin and Thompson consider the EXTERNAL environment relates to:

Answer 74

External Stakeholder expectations industry regulators behaviour of competitors general economic environment

Question 75

What would understanding the INTERNAL environment help us understand

Answer 75

What are our objectives what is our capacity what are our business processes how do we make decisions

Question 76

What would understanding the EXTERNAL environment help us understand

Answer 76

What does the world look like around us what is driving our strategic direction

Question 77

Name some tools and techniques that can help you understand INTERNAL and EXTERNAL context

Answer 77

Extended Enterprise PESTLE Stakeholder Mapping Horizon Mapping

Question 78

What is an Extended Enterprise

Answer 78

a structure where a number of organisations come together in a joint endeavour in order to achieve outcomes that none of them could have achieved on their own.” 

Question 79

What are the four key elements of an Extended Enterprise

Answer 79

1. Core activities of team, function, dept, project being considered 2. Key inputs to those core activities - what do you need to do 3. Key outputs from core activities - what is it that you deliver 4. The external influences that can affect those inputs, core activities and outputs.

Question 80

PESTLE

Answer 80

Political ,Economic ,Social  Technological ,Legal ,Environmental (or Ethical Hopkin/Thompson)

Question 81

What is stakeholder mapping

Answer 81

Assessment of important/influence/attitude of Int/Ext stakeholders.

Question 82

What is horizon scanning

Answer 82

A technique looking at complexity, challenge assumptions and review multiple ways that events could unfurl, in order to increase the resilience and reliability of their organisations Can do 3 times looking at across the near, mid and long term.