Risk Management Concepts, Frameworks and Risk Assessment
Core concepts
Risk is the effect of uncertainty on objectives - it is not synonymous with loss. Candidates must know two dominant frameworks: ISO 31000 (scope/context → risk identification → analysis → evaluation → treatment → monitoring and review, with communication and consultation throughout) and COSO ERM, organised around governance and culture, strategy and objective-setting, performance, review and revision, and information/communication/reporting.
Distinguish carefully. Risk appetite is the amount and type of risk an entity is willing to pursue or retain, set at board level. Risk tolerance is the acceptable variation around a specific objective or KPI. Risk capacity is the maximum risk the entity could bear before failure. Inherent (gross) risk is assessed before controls; residual risk after controls. Controls may act on likelihood, on consequence, or both.
Treatment options are avoid, reduce, transfer/share (insurance, outsourcing, contracts) and accept. Residual risk must be compared with appetite and accepted at the correct delegated authority. The three lines model allocates ownership: management owns risk, a risk/compliance function monitors, internal audit provides independent assurance.
Traps in questions
- Treating 'accept' as a failure - acceptance within appetite is a valid, documented decision.
- Quoting a residual score from an untested control; if evidence is absent, score inherent risk.
- Confusing appetite (board-level, portfolio) with tolerance (objective-level, operational).
- Assuming risk registers must capture only negative events.
Worked example
A payment-fraud risk scores likelihood 5 × consequence 4 = 20 (high). A new dual-authorisation control reduces likelihood to 2, giving residual 2 × 4 = 8. If the board's threshold for this category is 9, the residual is within appetite and can be accepted and monitored via a KRI (e.g. exception rate per 1,000 payments) rather than escalated.
Rule of thumb: always state whether a score is inherent or residual, and name the evidence that justifies the movement between them.