ISO-31000-CLA Practice Exam Questions with Answers ISO 31000 - Certified Lead Risk Manager Certification

Uncertainties may involve the process used to conduct the risk analysis and differing abilities among risk analysts. These are examples of factors that can affect the quality and reliability of risk assessment1.

Scoping framework boundaries is a major challenge in implementing the ISO 31000:2018 risk management framework. Scoping framework boundaries involves defining the scope of application of risk management within the organization’s context,

structure, and objectives.

 Key risk indicators are metrics that provide information about potential changes in the level of risk exposure3. They can help an organisation monitor and manage its risks more effectively. Key control indicators are metrics that measure the performance of internal controls4.

Records and reports provide a continuing account of the risk management system2. They help to monitor and review the performance and effectiveness of risk management.

Enhanced risk management emphasizes the continual improvement of risk management capabilities1. This means that risk management is regularly reviewed and updated to ensure its relevance, adequacy, and effectiveness.

According to , page 9, defining the context involves “understanding what influences people’s perception and tolerance of risks”. Discussing how girls are viewed by community members can help identify potential sources of resistance, conflict or violence that may affect the project’s objectives and outcomes.

Human element is often the biggest challenge in risk implementation. Human element involves overcoming resistance to change, engaging stakeholders, building trust and commitment, and fostering a positive risk culture.

According to page 9-10 of source 2, risk management professionals organize internal and external information about the organization into categories such as stakeholders, strategic objectives, policies and procedures, risk appetite and tolerance, and risk culture. This categorization process facilitates the analysis and reporting of the risk information at a later stage, making it easier to understand and use.

the last step of the risk assessment process, which starts with risk identification, moves to risk assessment, and finally risk evaluation, is Risk evaluation.

Risk evaluation involves comparing the estimated level of risk against the risk criteria established during the risk assessment phase, to determine the significance of the risk and whether it is acceptable or not. This decision is made in consultation with stakeholders, who may provide additional context and information to inform the decision.

The American Society for Quality (ASQ) describes risk evaluation as "the process of comparing an estimated risk against given risk criteria to determine the acceptability of the risk." [1]

Similarly, ISO/IEC 27001:2013 (Information technology — Security techniques — Information security management systems — Requirements) defines risk evaluation as "the process of comparing the estimated risk against given risk criteria in order to determine the significance of the risk." [2]

References: [1] ASQ Glossary - Risk evaluation, https://asq.org/quality-resources/risk-evaluation  [2] ISO/IEC 27001:2013, Clause 6.1.3(c), https://www.iso.org/standard/54534.html

According to 3, a captive insurance company is “a wholly owned subsidiary insurer that provides risk mitigation services for its parent company or related entities”. It can act as a reinsurer by accepting risks from other insurers or captives 1. It can also access reinsurance markets to transfer some of its own risks 1. It can sometimes offer greater cover than is available in the insurance market by tailoring its policies to suit its parent’s needs 3. It does not have to be located in the same country as its parent company; in fact, many captives are domiciledoffshore for tax or regulatory reasons 4.

A business interruption review is an evaluation of the effectiveness of a business continuity plan, which is a set of procedures and resources to ensure that an organisation can continue its critical functions in the event of a disruption12.

The Chief Risk Officer chairs the ERM/RM steering committee. The ERM/RM steering committee oversees the organization’s risk management activities and provides guidance and support to senior management.

The ISO 31000:2018 process can be used to identify stakeholder risk requirements, needs, and expectations4. This is part of establishing the context for risk management, which involves defining the scope, objectives, criteria, roles and responsibilities for risk management.

A large manufacturing organisation has renewed an insurance policy and has accepted a significant increase in the policy deductible. This is most likely to indicate increased risk retention, which means accepting more responsibility for potential losses5. This could be done to reduce insurance premiums or increase control over claims.

According to 2, FIRM scorecard is “a tool for measuring risk performance”. It uses four dimensions: financial impact, internal processes, reputation and market position (FIRM). Loss of income and financial gain are examples of financial impact risks that can be quantified using monetary values or ratios. Reputational damage is an example of reputation risk that is more difficult to quantify using objective measures.

Risk management ensures that value is created by identifying opportunities for investment, mergers, or acquisition. Risk management helps to assess the potential benefits, costs, and risks of different options and make informed decisions.

Risk management is a strategic management process2. Risk management helps organizations to align their objectives, strategies, and actions with their external and internal environment.

According to , page 11, scenario based risk identification involves “creating different scenarios based on varying assumptions about how events might unfold”. This can help explore alternative ways to achieve an objective under different circumstances.

A pure risk only leads to the possibility of a loss, whereas a speculative risk may lead to a gain12. For example, entering into a contract to purchase a new factory is a speculative risk, as it could result in either profit or loss depending on market conditions.

Residual risk is the type of risk that remains after risk treatment has been applied1. Residual risk reflects the remaining exposure or uncertainty after taking into account existing controls.

Transparency and inclusiveness are key ISO 31000:2018 attributes. Transparency means that risk management activities are visible, understandable, and verifiable by relevant stakeholders. Inclusiveness means that appropriate stakeholders are involved in risk management decisions and actions.

According to ISO31000 (2018), clause 1., it is “not intended for certification purposes”. It provides guidance on how organizations can manage their risks effectively using a systematic approach based on principles, framework and process 3.

According to 3, clause 6.5., monitoring and review “is intended as a feedback loop for checking whether any change has occurred either internally or externally that may affect performance against objectives”. It helps to ensure that the risk management process remains relevant and effective over time.

According to , page 17, a crisis management team (CMT) is “a group of senior managers who have been delegated authority by an organization’s executive leadership team to make decisions during a crisis”. A centralized decision making structure allows for faster and more coordinated responses in an emergency situation.

According to ISO/IEC Guide73 (2009), clause 1., risk is defined as “the effect of uncertainty on objectives”. This definition applies to both ISO/IEC Guide73 (2009) and ISO31000 (2018), which are standards for risk management terminology and principles respectively.