GRC Enterprise Risk Management Frameworks 4 — Questions and Answers
Question 1: Which quantitative technique uses repeated random sampling to model the probability distribution of risk outcomes?
- SWOT analysis
- Delphi technique
- Monte Carlo simulation (Correct answer)
- Bowtie analysis
Correct answer: Monte Carlo simulation
Monte Carlo simulation runs thousands of random scenarios to produce a probability distribution of possible outcomes, quantifying risk exposure.
Question 2: ISO 31000:2018 identifies 'communication and consultation' as a process that should occur at which stage of the risk management process?
- Only during risk assessment
- Only during risk treatment
- Throughout all stages of the risk management process (Correct answer)
- Only when risks are escalated to the board
Correct answer: Throughout all stages of the risk management process
ISO 31000 specifies that communication and consultation with stakeholders should be an ongoing activity throughout all stages of the risk management process.
Question 3: What is the purpose of scenario analysis in ERM?
- To calculate exact loss amounts for each risk
- To explore plausible future states and assess their potential risk impacts (Correct answer)
- To rank risks based on historical frequency data
- To assign monetary values to intangible assets
Correct answer: To explore plausible future states and assess their potential risk impacts
Scenario analysis examines hypothetical but plausible situations to evaluate how different conditions could affect organizational risk exposure.
Question 4: Which COSO ERM 2017 component focuses on tracking performance against risk-adjusted targets and identifying changes in risk?
- Governance and Culture
- Strategy and Objective-Setting
- Review and Revision (Correct answer)
- Information and Communication
Correct answer: Review and Revision
Review and Revision involves monitoring the ERM program's effectiveness, tracking performance, and updating the approach as the risk landscape changes.
Question 5: A financial institution sets a maximum acceptable loss of $5 million from operational risk events per quarter. This figure most directly represents:
- Risk tolerance (Correct answer)
- Risk capacity
- Risk appetite
- Residual risk
Correct answer: Risk tolerance
Risk tolerance is the specific, measurable boundary around acceptable variation in outcomes — it operationalizes the broader risk appetite statement.
Question 6: What is the role of the Chief Risk Officer (CRO) in an ERM program?
- Auditing internal controls independently of management
- Owning all operational risks across the enterprise
- Overseeing the ERM framework and ensuring risk is integrated into strategic decisions (Correct answer)
- Approving all financial transactions above a certain threshold
Correct answer: Overseeing the ERM framework and ensuring risk is integrated into strategic decisions
The CRO leads the ERM function, designs the risk framework, and ensures risk considerations are embedded in strategy and business processes.
Question 7: Which risk aggregation concept describes the situation where multiple, individually manageable risks combine to produce an unexpectedly large total exposure?
- Risk velocity
- Risk correlation (Correct answer)
- Concentration risk
- Tail risk
Correct answer: Risk correlation
Risk correlation describes how risks move together; highly correlated risks can aggregate to create losses far larger than independent assessment would suggest.
GRC Enterprise Risk Management Frameworks 4
Which quantitative technique uses repeated random sampling to model the probability distribution of risk outcomes?