Enterprise Risk Management & Governance Flashcards

What is the primary objective of Enterprise Risk Management (ERM)?

Answer: To help achieve objectives by managing risks enterprise-wide

Enterprise Risk Management (ERM) aims to help an organization achieve its strategic objectives by systematically identifying, assessing, and managing risks across all its functions and departments. It's about optimizing risk-taking to create value, not eliminating all risks, which is often impossible and impractical.

Which framework is widely used for ERM implementation?

Answer: COSO ERM Framework

The COSO ERM Framework, developed by the Committee of Sponsoring Organizations of the Treadway Commission, is a globally recognized and comprehensive framework for designing and implementing effective enterprise risk management. It provides principles and guidance for organizations to manage risks and integrate ERM into their overall strategy and performance.

Who is typically responsible for overseeing ERM within an organization?

Answer: Chief Risk Officer

The Chief Risk Officer (CRO) is a senior executive specifically tasked with overseeing and managing an organization's overall risk management strategy. This role involves identifying, assessing, and mitigating risks across all business units to protect assets and ensure the achievement of strategic objectives.

Which of the following is an example of a strategic risk?

Answer: Changes in regulatory policies

Strategic risks are those that affect an organization's ability to achieve its long-term goals and objectives. Changes in regulatory policies can significantly impact a company's business model, market position, and future growth prospects, making it a prime example of a strategic risk that requires high-level attention.

What does 'risk appetite' refer to?

Answer: The amount of risk an organization is willing to accept

Risk appetite defines the overall level of risk an organization is willing to accept in pursuit of its strategic objectives. It serves as a guiding principle for decision-making, ensuring that the organization's risk-taking activities remain within acceptable boundaries aligned with its strategic goals and values.

Why is risk governance essential in ERM?

Answer: To ensure risk activities align with strategic goals

Risk governance provides the structure and oversight necessary to integrate ERM into an organization's overall strategy and decision-making processes. It ensures that risk management activities are consistent with the organization's risk appetite and contribute directly to achieving its strategic objectives, rather than merely serving a compliance function.

Which of the following best describes 'risk tolerance'?

Answer: The acceptable deviation from risk appetite

Risk tolerance refers to the specific, measurable boundaries of acceptable deviation from the organization's defined risk appetite for particular objectives or risk categories. While risk appetite is a high-level statement, risk tolerance provides more granular limits, indicating how much variation is permissible before action is required.

What is a risk register used for?

Answer: To record and manage identified risks

A risk register is a critical tool in risk management, serving as a central repository for documenting all identified risks. It typically includes details such as risk descriptions, potential impacts, likelihood, mitigation strategies, and assigned ownership, enabling systematic tracking and management of risks throughout their lifecycle.

Which concept ensures that risk ownership is clearly assigned within an organization?

Answer: Risk ownership

Risk ownership is the concept that clearly assigns accountability for managing specific risks to individuals or departments within an organization. This ensures that risks are actively monitored, controlled, and mitigated, preventing them from being overlooked or falling through the cracks due to unclear responsibilities.