Enterprise Risk Management Flashcards

In the DoD Enterprise Risk Management (ERM) framework, what is the primary purpose of a risk register?

Answer: To record identified risks along with their likelihood, impact, owners, and mitigation status

A risk register is the central ERM tool that catalogs all identified risks, their assessed probability and impact, assigned risk owners, chosen response strategies, and current mitigation status. It enables systematic enterprise-wide risk monitoring and reporting to leadership.

Within the DoD ERM framework, 'risk appetite' is best defined as:

Answer: The amount and type of risk an organization is willing to accept in pursuit of its objectives

Risk appetite defines how much and what kinds of risk leadership is willing to accept while pursuing mission objectives. It differs from risk tolerance (acceptable variance around targets) and residual risk (remaining risk after controls). Setting risk appetite is a senior leadership responsibility.

How does the DoD Enterprise Risk Management framework relate to the Committee of Sponsoring Organizations (COSO) ERM framework?

Answer: DoD adopted the COSO ERM framework as its conceptual foundation, adapting it for the defense environment

DoD's ERM approach is grounded in the COSO Enterprise Risk Management — Integrating with Strategy and Performance (2017) framework, adapted for the government and defense context. This provides a common, internationally recognized methodology aligned with both federal and private sector best practices.

In ERM terminology, 'residual risk' refers to:

Answer: Risk that remains after risk response measures and controls have been applied

Residual risk is the exposure that remains after all selected risk responses — mitigations, controls, transfers — have been implemented. If residual risk still exceeds the organization's risk tolerance, additional responses or acceptance by senior leadership may be required.

Which of the following correctly lists the four primary risk response strategies in an ERM framework?

Answer: Accept, Avoid, Mitigate, Transfer

The four standard ERM risk response strategies are: Accept (tolerate the risk within appetite), Avoid (stop the activity generating the risk), Mitigate (reduce likelihood or impact), and Transfer (shift risk to another party via insurance, contracts, or partnerships).

Within the DoD ERM framework, what distinguishes Enterprise Risk Management from the traditional internal controls program required by the Federal Managers' Financial Integrity Act (FMFIA)?

Answer: ERM addresses strategic, operational, and mission risks across the enterprise, while FMFIA internal controls focus on process-level compliance and financial reporting integrity

FMFIA internal controls are process-level mechanisms ensuring compliance, safeguarding assets, and reliable financial reporting. ERM is a broader, enterprise-wide discipline that integrates risk management into strategic planning and mission execution across all risk categories — including strategic, operational, financial, and reputational risks.