Principles of Risk Management
Core idea
Risk management is a structured, repeatable discipline for making uncertainty explicit so that decisions are deliberate rather than accidental. A candidate must be able to define risk as the effect of uncertainty on objectives, distinguishing it from a hazard (a source of harm) and from an issue (an uncertainty that has already materialised). Understand the distinction between inherent risk (before controls) and residual risk (after controls), and between gross and net exposure in financial terms.
Concepts to master
Know the standard process cycle: establish context, identify, analyse, evaluate, treat, communicate, monitor and review. Recognise principles such as proportionality (effort should match the significance of the risk), integration (risk thinking embedded in normal decisions, not a parallel bureaucracy), and the three-lines model of accountability. Understand risk appetite (the amount of risk an organisation is willing to pursue) versus risk tolerance (the acceptable variation around that appetite) and risk capacity (the maximum it could bear).
Traps
Questions often swap appetite for tolerance, or imply risk management's purpose is elimination of risk. It is not: it is optimisation within appetite. Another trap is treating the process as strictly linear; communication and monitoring are continuous and feed every stage. Candidates also confuse a risk owner (accountable for managing a specific risk) with a risk champion or a control owner.
Worked rule of thumb
A firm sets appetite at 'no more than 2% of annual revenue at risk from any single supplier'. A proposed supplier creates 3.5% exposure. The correct response is not automatic rejection but escalation: reduce exposure through contractual limits, insurance or dual sourcing until residual exposure sits inside appetite, or obtain a documented exception from the accountable executive.