GRC Enterprise Risk Management Frameworks 2

Question 1

Which COSO ERM component is responsible for setting the tone at the top and defining the organization's risk appetite?

Accepted Answer

Governance and Culture

Answer

Governance and Culture is the COSO ERM 2017 component that establishes tone at the top, risk culture, and risk appetite.

Question 2

In ISO 31000:2018, what is the term for the potential positive or negative consequence of a risk event?

Accepted Answer

Consequence

Answer

ISO 31000 defines 'consequence' as the outcome of an event affecting objectives, which can be positive or negative.

Question 3

A company maps risks on a heat map where the x-axis is likelihood and the y-axis is impact. Which quadrant demands immediate attention?

Accepted Answer

High likelihood, high impact

Answer

Risks with high likelihood and high impact fall in the critical quadrant requiring immediate treatment and senior management focus.

Question 4

What distinguishes 'inherent risk' from 'residual risk' in an ERM framework?

Accepted Answer

Residual risk accounts for controls; inherent risk does not

Answer

Inherent risk is the raw risk before controls are applied; residual risk is what remains after controls are in place.

Question 5

Under the COSO ERM framework, which element directly links risk strategy to business objectives?

Accepted Answer

Strategy and Objective-Setting

Answer

Strategy and Objective-Setting is the COSO ERM component where risk appetite is applied to align strategy with organizational objectives.

(GRC) Governance, Risk, and Compliance Certification Practice Test