SAMRA study guide
SAMRA · Work through your exam, one topic at a time.
The SAMRA exam tests whether a candidate can run a risk assessment end to end: framing the risk question, choosing a method, gathering evidence, scoring likelihood and consequence, deciding on treatment, and communicating the result to people who will act on it. It is aimed at practitioners who already touch risk in their work - risk officers, project and program managers, auditors, compliance and operations staff, analysts, and engineers with safety or quality responsibilities - and who want a structured, defensible way to demonstrate that competence. The SAMRA study guide has 8 sections and about 3,139 words.
01Fundamentals of Risk Management and Risk Assessment
The Fundamentals domain tests whether you can define risk precisely, distinguish it from neighbouring ideas, and use the ISO 31000:2018 principles and process as a working model rather than a diagram to recite. Risk is the “effect of uncertainty on objectives” (ISO 31000:2018).
448 words, about 2 min02Risk Identification, Analysis, and Evaluation
Identification, analysis and evaluation are examined together because candidates often jump from a list of risks to a colour on a heat map without showing the reasoning in between. Use more than one technique: brainstorming, structured interviews, Delphi, checklists, process mapping, HAZOP for process deviations, FMEA for failure modes, bow-tie for causes and consequences, fault and event trees, SWOT and PESTLE for context, incident reviews, audit findings, KRI triggers and horizon scanning.
376 words, about 2 min03Risk Treatment and Control
Treatment converts assessment into changed exposure. The exam tests whether you can select options from ISO 31000, justify them against cost and benefit, and state the residual risk and who accepts it.
361 words, about 2 min04Risk Communication and Reporting
Communication and reporting turn risk work into decisions. This domain tests stakeholder analysis, the ISO 31000 communication and consultation process, escalation rules, and reporting that is timely, material and honest.
382 words, about 2 min05Monitoring, Review, and Continuous Improvement
Monitoring, review and continual improvement ask whether risk management is working, not merely whether it is happening. The exam tests KRI design, assurance coordination, review triggers and the discipline of updating the register and treatment plans.
366 words, about 2 min06Governance, Frameworks, and Standards
Governance questions ask who is accountable, what authority they have, and which framework does what. Candidates lose marks by naming standards without explaining their scope or by conflating the three lines.
408 words, about 2 min07Risk Management in Projects and Programs
Project and program risk questions test whether you can separate project uncertainty from enterprise risk, run the risk process across a lifecycle, and quantify exposure without pretending precision. Plan risk management, identify risks, perform qualitative analysis, perform quantitative analysis where warranted, plan responses, implement responses, and monitor.
407 words, about 2 min08Emerging Risks and Organizational Resilience
Emerging risk questions test whether you can reason under high uncertainty without pretending to have frequency data, and whether you understand resilience as a capability rather than a plan on a shelf. Novelty, high uncertainty, weak or conflicting data, systemic connections, and potentially fast velocity.
391 words, about 2 min