ARM Risk Management Framework Principles 2 — Questions and Answers
Question 1: Under ISO 31000, which framework component is at the center and drives all other components?
- Integration
- Leadership and commitment (Correct answer)
- Design
- Evaluation
Correct answer: Leadership and commitment
ISO 31000 places leadership and commitment at the core of the framework, supporting integration, design, implementation, evaluation, and improvement.
Question 2: A company's risk management policy was written five years ago and has never been reviewed despite major market changes. Which ISO 31000 principle is most clearly being violated?
- Inclusive
- Structured and comprehensive
- Dynamic (Correct answer)
- Customized
Correct answer: Dynamic
The dynamic principle requires risk management to anticipate, detect, and respond to changes in the internal and external context.
Question 3: In ISO 31000, which three activities together make up risk assessment?
- Identification, analysis, and evaluation (Correct answer)
- Identification, treatment, and monitoring
- Scope, context, and criteria
- Analysis, treatment, and reporting
Correct answer: Identification, analysis, and evaluation
ISO 31000 defines risk assessment as the overall process of risk identification, risk analysis, and risk evaluation.
Question 4: Which of the following best describes the purpose of establishing risk criteria?
- To list every risk the organization faces
- To assign a risk owner to each department
- To transfer risks to insurers
- To define the terms of reference against which the significance of risk is evaluated (Correct answer)
Correct answer: To define the terms of reference against which the significance of risk is evaluated
Risk criteria set the benchmarks for judging whether a risk is acceptable or needs treatment.
Question 5: An organization adapts its risk framework to fit its size, culture, and objectives rather than copying a competitor's model. Which ISO 31000 principle does this reflect?
- Integrated
- Customized (Correct answer)
- Best available information
- Continual improvement
Correct answer: Customized
The customized principle states the framework and process should be tailored to the organization's external and internal context and objectives.
Question 6: Which statement best distinguishes enterprise risk management (ERM) from traditional risk management?
- ERM considers only hazard risks
- ERM focuses solely on insurable risks
- ERM addresses all risk types across the organization in an integrated, portfolio view (Correct answer)
- ERM eliminates the need for insurance
Correct answer: ERM addresses all risk types across the organization in an integrated, portfolio view
ERM takes an organization-wide, portfolio approach that includes strategic, operational, financial, and hazard risks.
Question 7: Within the ISO 31000 process, which activity applies at every step rather than as a single stage?
- Communication and consultation (Correct answer)
- Risk evaluation
- Risk treatment
- Establishing risk criteria
Correct answer: Communication and consultation
Communication and consultation with stakeholders runs through every step of the risk management process.
