Risk Management Fundamentals
The core toolkit
Candidates must be fluent in the risk management process: identify, assess, treat, monitor, and report. Assessment combines likelihood and impact, often through a risk matrix or heat map, and should distinguish inherent risk (before controls) from residual risk (after controls). Treatment options are traditionally accept, avoid, transfer, and mitigate - sometimes extended with exploit for positive risk. Key control concepts include preventive versus detective controls, key risk indicators, control testing, and the concept of risk appetite versus risk tolerance.
Traps to watch
A frequent trap is asking for the next step after a risk is identified - the answer is usually to assess it, not to immediately mitigate. Another is conflating inherent and residual risk; questions may present a control failure and expect you to recognize that residual risk has increased. Watch for confusion between a risk indicator (a metric signaling changing exposure) and a control (an action reducing exposure). Also be alert to transfer misconceptions: insurance transfers financial consequence, not accountability or reputational harm.
Rule of thumb
Residual risk = inherent risk adjusted for the effectiveness of controls. If controls are untested, treat residual risk as closer to inherent.
Worked example
A payment team identifies a fraud risk rated high inherent likelihood and high impact. A new dual-approval control is designed but never tested. On an exam, the defensible answer is that residual risk remains high until the control is operating effectively and evidenced by testing - design alone does not reduce assessed residual risk.