CDFM Enterprise Risk Management

Question 1

In the DoD Enterprise Risk Management (ERM) framework, what is the primary purpose of a risk register?

Accepted Answer

To record identified risks along with their likelihood, impact, owners, and mitigation status

Answer

A risk register is the central ERM tool that catalogs all identified risks, their assessed probability and impact, assigned risk owners, chosen response strategies, and current mitigation status. It enables systematic enterprise-wide risk monitoring and reporting to leadership.

Question 2

Within the DoD ERM framework, 'risk appetite' is best defined as:

Accepted Answer

The amount and type of risk an organization is willing to accept in pursuit of its objectives

Answer

Risk appetite defines how much and what kinds of risk leadership is willing to accept while pursuing mission objectives. It differs from risk tolerance (acceptable variance around targets) and residual risk (remaining risk after controls). Setting risk appetite is a senior leadership responsibility.

Question 3

How does the DoD Enterprise Risk Management framework relate to the Committee of Sponsoring Organizations (COSO) ERM framework?

Accepted Answer

DoD adopted the COSO ERM framework as its conceptual foundation, adapting it for the defense environment

Answer

DoD's ERM approach is grounded in the COSO Enterprise Risk Management — Integrating with Strategy and Performance (2017) framework, adapted for the government and defense context. This provides a common, internationally recognized methodology aligned with both federal and private sector best practices.

Question 4

In ERM terminology, 'residual risk' refers to:

Accepted Answer

Risk that remains after risk response measures and controls have been applied

Answer

Residual risk is the exposure that remains after all selected risk responses — mitigations, controls, transfers — have been implemented. If residual risk still exceeds the organization's risk tolerance, additional responses or acceptance by senior leadership may be required.

Question 5

Which of the following correctly lists the four primary risk response strategies in an ERM framework?

Accepted Answer

Accept, Avoid, Mitigate, Transfer

Answer

The four standard ERM risk response strategies are: Accept (tolerate the risk within appetite), Avoid (stop the activity generating the risk), Mitigate (reduce likelihood or impact), and Transfer (shift risk to another party via insurance, contracts, or partnerships).

CDFM - Certified Defense Financial Manager Practice Test

CDFM - Certified Defense Financial Manager Practice Test

CDFM Enterprise Risk Management