Unit 1

Question 1

IRM definition of risk

Answer 1

Uncertainties that matter. The term risk is used to denote the effect of uncertainty of objectives, considering both threats and opportunities

Question 2

ISO 31000 definition of RM

Answer 2

Coordinated activities to direct and control an organisation in regards to risk.
Effective risk management allows organisations to identify, understand and manage risks

Question 3

IRM definition of ERM

Answer 3

To support ALL organisational activities, RM has evolved into ERM. This recognises that risks are all interrelated and that the culture, capabilities and practices within an organisation are just as important to add value as the processes, policies and procedures.

Question 4

4 steps of risk based decision making

Answer 4

Define context and objectives
Assess the risks
Manage the risks
Monitor, review and report

Question 5

PRAM

Answer 5

Project risk analysis and management

Approach and guidance to dealing with project risk. Project risk management is a RM specialism
Common themes of projects are uniqueness, time constraints, reliance on third parties, complex etc. These bring a range of uncertainty

Question 6

ISO 31000 (2018) risk management standard

Answer 6

Risk management is based on the principles (what good risk management looks like), framework (what is needed to implement effective rm) and the processes (what the steps are in rM)

Question 7

COSO (2004) risk management standard

Answer 7

It was first written to combat fraudulent.

It is a cube made up of:
Top face = 4 categories of organisational objectives (STOC)
Front face = 8 steps of the RM process
Side face = 4 categories of the implementation process

Question 8

COSO (2017) risk management standard

Answer 8

ERM rainbow double helix.
Created to provider greater insight into the link between strategy, risk and performance

It considers how to enhance performance in line with an orgs strategy and how to manage risks in a way aligned to the strategy.

Comprised of 20 principle

Question 9

Risks can be considered as having long, medium or short term impacts

Answer 9

This is a way of analysing the risk exposure of an organisation.

Long = strategy. Impact over years after the event occurs or the decision is taken.
Medium = tactics. They have their impact some time after the event occurs, will be about a year later. Associated with projects.
Short = operation. They have their impact immediately after the event occurs, and cause immediate disruption to normal efficient operations

Question 10

COBIT

Answer 10

Standard applicable to IT risk management

Question 11

How does the US RM association (RIMS) define ERM

Answer 11

A strategic business discipline that supports the achievement of an orgs objectives by addressing the full spectrum of its risks and managing the combined impact of those risks as an interrelated risk portfolio.

Question 12

Maturity levels of RM (4)

Answer 12

Inform = unaware of obligations
Reform = awareness of non compliance
Conform = actions to ensure compliance
Perform = achieve business opportunities
Deform = inactivity caused by obsession

Question 13

5 objectives of RM

Answer 13

MADE2:
M = mandatory
A = assurance
D = decision making
E = effective
E= and efficient core process

Question 14

What does compliance management provide

Answer 14

Risk governance

Question 15

What does hazard management do?

Answer 15

Makes outcomes less negative

Question 16

What does control management reduce

Answer 16

The range of possible outcomes

Question 17

What does opportunity management do

Answer 17

Maximise the benefits of possible outcomes

Question 18

ISO 31000 definition of risk

Answer 18

Effect of uncertainty on objectives

Question 19

Hillson (2016) defines risk as

Answer 19

Uncertainties that matter

Question 20

ISO 31000 (2018) notes that an effect is

Answer 20

A deviation from the expected. It can be positive or negative or both, and can address, create or result in opportunities and threats

Question 21

IRM (2002) RM Standard considers risk as

Answer 21

A combo of the probability of an event and its consequences. Consequences can range from pos to neg

Question 22

IRM considers risk as

Answer 22

Uncertainties that matter

Question 23

IS0 31000 definition of rM

Answer 23

Coordinated activities to direct and control an org with regard to risk

Question 24

Risk exposure

Answer 24

The total assessment that ERM enables orgs to do. ERM stresses the need to consider the interdependency between risks

Question 25

The definitions of risks include three concepts

Answer 25

Something that is uncertain, can be both positive and negative, something that will impact what we are trying to achieve

Question 26

What year were rm frameworks developed since

Answer 26

1995

Question 27

2004 - 2018 is a period when what occurred in relation to rm

Answer 27

International standards and frameworks developed

Question 28

GRC approach

Answer 28

Governance, risk and compliance. The EY Board Priorities 2022 report suggests that a way to achieve objectives, while addressing uncertainty, requires these three things, where there should be an integrated appraoch to compliance, risk management, internal controls, and internal audit

Question 29

RM specialism = finance

Answer 29

Heavily regulated and key focus on management risks that can have a financial impact

Sarbanes o ley law mandates certain practices in financial record keeping and reporting for corporation

Question 30

Banking sector regulator

Answer 30

International Basel accord

Question 31

Insurance sector regulator

Answer 31

European Union Solvency 2

Question 32

What year was the health and safety act created

Answer 32

1974

Question 33

What is a risk standard

Answer 33

A published guide for managing risk, compromising of a risk framework and a risk process

Question 34

Coso (2017) update to the cube

Answer 34

• update to reflect changing complexity of risks and the evolving business enviornment
• it emphasises that orgs that integrate eRM throughout the entity can realise many more benefits
• Update provides insight into the links between strategy, risk and performance, and highlights the inter connectedness of risks and the effect that risk culture has on the implemention of rm

Question 35

Three distinct approaches followed in standards

Answer 35

• risk management approach = iso
• internal control = COSO and FRC
• risk aware culture = COCO