GRC Enterprise Risk Management Frameworks 2

Question 1

Which COSO ERM component is responsible for setting the tone at the top and defining the organization's risk appetite?

Accepted Answer

Governance and Culture

Answer

Control Activities

Answer

Information and Communication

Answer

Review and Revision

Question 2

In ISO 31000:2018, what is the term for the potential positive or negative consequence of a risk event?

Accepted Answer

Consequence

Answer

Likelihood

Answer

Risk owner

Answer

Risk criterion

Question 3

A company maps risks on a heat map where the x-axis is likelihood and the y-axis is impact. Which quadrant demands immediate attention?

Accepted Answer

High likelihood, high impact

Answer

Low likelihood, low impact

Answer

High likelihood, low impact

Answer

Low likelihood, high impact

Question 4

What distinguishes 'inherent risk' from 'residual risk' in an ERM framework?

Accepted Answer

Residual risk accounts for controls; inherent risk does not

Answer

Inherent risk accounts for controls; residual risk does not

Answer

Inherent risk is quantitative; residual risk is qualitative

Answer

Residual risk is always higher than inherent risk

Question 5

Under the COSO ERM framework, which element directly links risk strategy to business objectives?

Accepted Answer

Strategy and Objective-Setting

Answer

Risk identification

Answer

Performance

Answer

Risk appetite statement

Question 6

Which risk response strategy involves sharing risk through insurance or outsourcing?

Accepted Answer

Transfer

Answer

Avoid

Answer

Accept

Answer

Reduce

Question 7

What is the primary purpose of a Risk Appetite Statement in an ERM program?

Accepted Answer

To set boundaries on how much risk the organization will accept in pursuit of its strategy

Answer

To enumerate every risk the organization faces

Answer

To assign risk owners to each identified risk

Answer

To document past risk events and their impacts