P3 - 1/2. Risk Management Flashcards
What are the 2 main types of risk?
- Strategic (overall positioning)
- Operational (day to day)
What are the 5 main risks in IS/IT systems?
- Physical threats
- Virus infection
- Infrastructure failure
- Human error
- Business interruption
What are the 5 additional risks brought on by operating overseas?
- Currency risk
- Cultural risk
- Transit risk
- Credit risk
- Political risk
What are the 7 stages in CIMA’s risk management cycle?
- Establish RM group and goals
- Identify risk areas
- Assess scale of risk
- Develop risk response strategy
- Implement and allocate responsibilities
- Implement and monitor controls
- Review, refine and repeat
What are the 3 main roles of a risk management group?
- Coordinate overall RM process
- Set out approach to RM
- Communicate risk appetite
What 3 things should be assessed when identifying risk areas?
- Environment (PESTLE)
- Economic conditions
- Key stakeholders
What 3 things can be evaluated when assessing the scale of a risk?
- Consequence
- Likelihood
- Controllability
What are the 4 main categories of risk response?
- Avoid (high likelihood, high impact)
- Reduce (high likelihood, low impact)
- Transfer (low likelihood, high impact)
- Accept (low likelihood, low impact)
What does Portfolio theory suggest?
The best way to reduce risk is to diversify sources of income (market expansion or diversification)
Who should be involved in monitoring controls around risk management?
Internal audit
According to COSO, what are the 5 key considerations of an effective RM framework?
- Governance and culture
- Strategy and objective setting
- RM Performance
- Review and revision
- Information, communication and reporting
What are the 3 elements of the ISO risk management framework?
- Leadership and Commitment
- Value Creation and Protection
- Risk Reporting Process
What are ISOs 3 underlying principles of effective RM?
- As an iterative process
- Part of governance and leadership
- Considers internal and external factors
What is an assurance map?
Identifies the main sources and types of assurance in the organisation, analyses the quality and determines action based on gaps
