CDFM Enterprise Risk Management — Questions and Answers
Question 1: In the DoD Enterprise Risk Management (ERM) framework, what is the primary purpose of a risk register?
- To document all financial transactions for audit trail purposes
- To record identified risks along with their likelihood, impact, owners, and mitigation status (Correct answer)
- To list all active government contracts and their performance metrics
- To capture internal control deficiencies identified during Inspector General reviews
Correct answer: To record identified risks along with their likelihood, impact, owners, and mitigation status
A risk register is the central ERM tool that catalogs all identified risks, their assessed probability and impact, assigned risk owners, chosen response strategies, and current mitigation status. It enables systematic enterprise-wide risk monitoring and reporting to leadership.
Question 2: Within the DoD ERM framework, 'risk appetite' is best defined as:
- The total count of risks recorded in the organization's risk register
- The amount and type of risk an organization is willing to accept in pursuit of its objectives (Correct answer)
- The maximum financial loss an organization can absorb before mission failure
- The level of risk that remains after all mitigation controls have been applied
Correct answer: The amount and type of risk an organization is willing to accept in pursuit of its objectives
Risk appetite defines how much and what kinds of risk leadership is willing to accept while pursuing mission objectives. It differs from risk tolerance (acceptable variance around targets) and residual risk (remaining risk after controls). Setting risk appetite is a senior leadership responsibility.
Question 3: How does the DoD Enterprise Risk Management framework relate to the Committee of Sponsoring Organizations (COSO) ERM framework?
- DoD developed a fully independent methodology unrelated to COSO
- DoD adopted the COSO ERM framework as its conceptual foundation, adapting it for the defense environment (Correct answer)
- COSO applies only to publicly traded companies; DoD relies exclusively on GAO standards
- DoD ERM is based on ISO 31000 and explicitly rejects the COSO framework
Correct answer: DoD adopted the COSO ERM framework as its conceptual foundation, adapting it for the defense environment
DoD's ERM approach is grounded in the COSO Enterprise Risk Management — Integrating with Strategy and Performance (2017) framework, adapted for the government and defense context. This provides a common, internationally recognized methodology aligned with both federal and private sector best practices.
Question 4: In ERM terminology, 'residual risk' refers to:
- Risk identified but scored below the threshold requiring any management action
- Risk that remains after risk response measures and controls have been applied (Correct answer)
- Risk formally transferred to a third party through insurance or contract terms
- Risk inherited from predecessor programs or legacy systems
Correct answer: Risk that remains after risk response measures and controls have been applied
Residual risk is the exposure that remains after all selected risk responses — mitigations, controls, transfers — have been implemented. If residual risk still exceeds the organization's risk tolerance, additional responses or acceptance by senior leadership may be required.
Question 5: Which of the following correctly lists the four primary risk response strategies in an ERM framework?
- Audit, Report, Escalate, Archive
- Accept, Avoid, Mitigate, Transfer (Correct answer)
- Identify, Assess, Monitor, Close
- Prevent, Detect, Correct, Recover
Correct answer: Accept, Avoid, Mitigate, Transfer
The four standard ERM risk response strategies are: Accept (tolerate the risk within appetite), Avoid (stop the activity generating the risk), Mitigate (reduce likelihood or impact), and Transfer (shift risk to another party via insurance, contracts, or partnerships).
Question 6: Within the DoD ERM framework, what distinguishes Enterprise Risk Management from the traditional internal controls program required by the Federal Managers' Financial Integrity Act (FMFIA)?
- ERM focuses exclusively on cybersecurity risks, while FMFIA covers financial controls
- ERM is voluntary for DoD components, while FMFIA compliance is mandatory
- ERM addresses strategic, operational, and mission risks across the enterprise, while FMFIA internal controls focus on process-level compliance and financial reporting integrity (Correct answer)
- ERM applies only to combatant commands, while FMFIA applies to defense agencies
Correct answer: ERM addresses strategic, operational, and mission risks across the enterprise, while FMFIA internal controls focus on process-level compliance and financial reporting integrity
FMFIA internal controls are process-level mechanisms ensuring compliance, safeguarding assets, and reliable financial reporting. ERM is a broader, enterprise-wide discipline that integrates risk management into strategic planning and mission execution across all risk categories — including strategic, operational, financial, and reputational risks.
