Risk Management and Compliance
Risk management is a structured process for identifying, assessing, treating, monitoring, and reporting uncertainty that could affect objectives. Candidates must know the difference between inherent risk (before controls) and residual risk (after controls), and between likelihood and consequence as the two axes of assessment. Understand the treatment options: avoid, reduce, transfer, and accept. Acceptance must be at the right authority level, within the approved risk appetite, and documented.
Key concepts include the risk register, risk owner, key risk indicators, control testing, and the three lines model: operational management owns risk, a risk and compliance function provides frameworks and challenge, and internal audit provides independent assurance. Compliance is the obligation to meet laws, regulations, standards, and internal policy; a compliance framework maps obligations to controls and evidence.
Traps abound. One is treating a control as a treatment: a control reduces likelihood or consequence, but the treatment decision is the management choice. Another is confusing a risk with an issue: a risk is a future possibility, an issue is a current problem requiring action. A third is assuming transfer eliminates risk; insurance transfers financial consequence but leaves reputational and operational exposure. Also watch for questions that put risk acceptance below the authority that owns the appetite.
Rule of thumb: if a question asks what to do first when a new risk emerges, the answer is usually assess and escalate, not immediately implement a control.
Worked example: A supplier outage is assessed as high likelihood, high consequence. Reduce exposure with a secondary supplier, transfer part of the loss through contract terms, and document acceptance of the remaining residual risk by the accountable executive, with a key risk indicator tracking delivery delay.