CDFM Enterprise Risk Management

Question 1

In the DoD Enterprise Risk Management (ERM) framework, what is the primary purpose of a risk register?

Accepted Answer

To record identified risks along with their likelihood, impact, owners, and mitigation status

Answer

To document all financial transactions for audit trail purposes

Answer

To list all active government contracts and their performance metrics

Answer

To capture internal control deficiencies identified during Inspector General reviews

Question 2

Within the DoD ERM framework, 'risk appetite' is best defined as:

Accepted Answer

The amount and type of risk an organization is willing to accept in pursuit of its objectives

Answer

The total count of risks recorded in the organization's risk register

Answer

The maximum financial loss an organization can absorb before mission failure

Answer

The level of risk that remains after all mitigation controls have been applied

Question 3

How does the DoD Enterprise Risk Management framework relate to the Committee of Sponsoring Organizations (COSO) ERM framework?

Accepted Answer

DoD adopted the COSO ERM framework as its conceptual foundation, adapting it for the defense environment

Answer

DoD developed a fully independent methodology unrelated to COSO

Answer

COSO applies only to publicly traded companies; DoD relies exclusively on GAO standards

Answer

DoD ERM is based on ISO 31000 and explicitly rejects the COSO framework

Question 4

In ERM terminology, 'residual risk' refers to:

Accepted Answer

Risk that remains after risk response measures and controls have been applied

Answer

Risk identified but scored below the threshold requiring any management action

Answer

Risk formally transferred to a third party through insurance or contract terms

Answer

Risk inherited from predecessor programs or legacy systems

Question 5

Which of the following correctly lists the four primary risk response strategies in an ERM framework?

Accepted Answer

Accept, Avoid, Mitigate, Transfer

Answer

Audit, Report, Escalate, Archive

Answer

Identify, Assess, Monitor, Close

Answer

Prevent, Detect, Correct, Recover

Question 6

Within the DoD ERM framework, what distinguishes Enterprise Risk Management from the traditional internal controls program required by the Federal Managers' Financial Integrity Act (FMFIA)?

Accepted Answer

ERM addresses strategic, operational, and mission risks across the enterprise, while FMFIA internal controls focus on process-level compliance and financial reporting integrity

Answer

ERM focuses exclusively on cybersecurity risks, while FMFIA covers financial controls

Answer

ERM is voluntary for DoD components, while FMFIA compliance is mandatory

Answer

ERM applies only to combatant commands, while FMFIA applies to defense agencies