Risk Management: Core Concepts, Frameworks, and Terminology
Foundations
Risk management is the coordinated set of activities that directs and controls an organization with regard to risk. At its core sits the distinction between risk (the effect of uncertainty on objectives, expressed as a combination of likelihood and consequence) and issue (an uncertainty that has already materialized). Candidates must be fluent in the vocabulary chain: hazard, threat, vulnerability, exposure, likelihood, impact, inherent risk, residual risk, risk appetite, risk tolerance, and risk capacity. Appetite is the amount of risk an organization is willing to pursue to meet objectives; tolerance is the acceptable variation around that appetite; capacity is the maximum risk it can bear before failure.
Process and Frameworks
Know the ISO 31000 style lifecycle - establishing context, identification, analysis, evaluation, treatment, communication and consultation, monitoring and review - and be able to map it to COSO ERM's governance-and-culture, strategy-and-objective-setting, performance, review-and-revision, and information-communication-and-reporting components. Understand the treatment hierarchy (avoid, reduce, transfer, accept, and sometimes exploit) and the concept of the risk register, heat map, key risk indicator, and risk owner.
Traps to Expect
Questions often blur inherent vs. residual risk, or confuse a control with a treatment. Another frequent trap: treating quantitative approaches (Monte Carlo, expected monetary value) as always superior to qualitative ones - they are not; the choice depends on data quality and decision needs. Watch for wording that conflates risk identification with risk evaluation.
Rule of Thumb
Apply the 'so-what' test: a statement is only a risk if it names an uncertain event, its cause, and its effect on an objective. "Server outage" is incomplete; "hardware failure causing a two-day outage that breaches the 99.9% service commitment" is a usable risk statement.