Risk Management: Appetite, Assessment and Treatment
The core cycle
Risk management is a repeatable cycle: identify, assess, treat, monitor, and report. Candidates must be fluent in the difference between inherent risk (before controls) and residual risk (after controls), and in the components of risk: likelihood, impact, velocity, and duration. Risk appetite is the amount of risk the governing body is willing to accept in pursuit of objectives; tolerance is the measurable boundary; capacity is the maximum risk the organisation could bear before failure. A frequent exam distinction is that appetite is set by the board, while limits and thresholds are calibrated by management within that appetite.
Know the treatment options: avoid, reduce (control), transfer (insurance, contracts), and accept, each with an owner, a target date, and a residual position recorded. Understand control types: preventive versus detective, manual versus automated, and the concept of key controls versus compensating controls. Risk registers should capture cause, event, and consequence, not just a label like "cyber".
Traps to expect
Questions often present a control as eliminating risk; controls normally reduce likelihood or impact, and residual risk remains. Another trap: accepting risk without documented authority at the right level, or treating insurance as removing reputational risk. Beware options that confuse a risk indicator (a metric signalling change) with a risk limit (a boundary requiring escalation).
Worked example
A payment team reports residual risk of fraud as "low" because a new automated check exists. Worked answer: restate inherent exposure, evidence that the control is designed and operating (testing results), assign a named owner, and record the residual rating with the assumptions. If testing is absent, residual risk cannot be rated low.
Rule of thumb: a residual rating without evidence of control operation is an assumption, not an assessment.