Risk Management: From Appetite to Treatment
The core framework
Risk management identifies, assesses, treats, and monitors uncertainty that could affect objectives. A standard lifecycle: establish context, identify risks, analyze (likelihood and impact), evaluate against appetite, treat, and monitor/report. Candidates should be fluent in the vocabulary because questions frequently hinge on precise definitions.
Concepts to master
- Inherent vs. residual risk: inherent is before controls; residual is what remains after controls operate. Control effectiveness is what bridges them.
- Risk appetite vs. tolerance: appetite is the amount of risk the organization is willing to accept in pursuit of objectives; tolerance is the acceptable variation around a specific limit.
- Treatment options: avoid, reduce (mitigate), transfer (share, e.g., insurance), accept. Acceptance must be a conscious, documented decision at the right authority level.
- Risk register quality: risks should be stated as cause–event–effect, owned by a named individual, and linked to objectives. Vague labels like "reputational risk" are weak entries.
Traps in questions
A common trap is treating transfer as eliminating risk - insurance transfers financial consequences, not the underlying event or reputational harm. Another is assuming more controls always mean less risk; controls add cost and can create new failure modes. Questions may also blur the risk owner (accountable for managing the risk) with the risk function (facilitates and aggregates).
Worked example / rule of thumb
A supplier outage risk has inherent likelihood 4/5 and impact 4/5. After adding a qualified second supplier, residual likelihood falls to 2/5 with impact unchanged. The register should record both ratings and the specific control that changed the score. Rule of thumb: every residual rating should be traceable to named controls and a named owner.